Microsoft SC-500 Practice Test 27

Question 260

An auditor must prove a centrally assigned Virtual Network Manager Deny rule is effective on several production VM interfaces, while local NSG templates show Allow. Which verification should the engineer provide?

Examine packet flow, backend/listener and transit path before expanding allow rules.
Separate path permission from target identity authorization.
Inspect/export Network Watcher effective rules for the actual NICs, including central AVNM security-admin rules, and retain their applicable scope as audit evidence.
Submit only the local NSG allow-rule template and omit the effective central security-admin rule evaluation.

Explanation

Correct Answer

The audit needs deployed effective access evidence for the actual interfaces. Central Virtual Network Manager Deny can override a local NSG Allow; NIC-level effective rules show the applicable decision instead of only intended template state.

Incorrect Answers

Packet capture or listener inspection helps troubleshoot delivery, but does not satisfy this audit request to export the effective security-admin/NSG rules on several named NICs.

Application authorization is independent of the requested NIC-level evidence that a centralized AVNM security-admin Deny applies before the local NSG Allow.

A local Allow rule alone does not establish what the NIC can receive when a central AVNM security-admin Deny applies first. The audit must include the effective inherited policy.

Question 261

A firewall rule allowing TCP traffic was deployed, but packet captures still show TCP RST responses from the attempted private service. What should be traced before adding broader allow rules?

Inspect Network Watcher effective security rules on the NIC to see combined applied policy.
Validate DNS and next hop rather than calling it an RBAC failure.
Examine packet flow, backend/listener and transit path before expanding allow rules.
Explain AVNM admin-rule precedence from the effective rules output.

Explanation

Correct Answer

A firewall-rule allow is only one layer. Correlate the TCP reset sender and sequence with Network Watcher connection troubleshoot, routes, backend listener/guest firewall and appliance logs before broadening the rule.

Incorrect Answers

The NIC effective-rule inventory is relevant to NSG filtering, but it cannot identify whether a reset came from the backend service, an intermediate firewall or an invalid return path.

DNS/next-hop checks are useful where name resolution or routing is implicated, but the stated symptom is actual TCP resets, so examine who sent each reset and whether a listener or downstream security path caused it.

AVNM Deny precedence explains blocked flows when an admin rule matches, not a case where a new firewall rule matches and TCP resets still appear on the packet capture.

Question 262

A private endpoint-backed Azure service rejects a workload request even though its NSG permits the packet. Select TWO checks that independently establish (1) whether the application reaches the PRIVATE service endpoint and (2) whether that caller may perform the requested service operation.

Use a supported connectivity/IP-flow diagnostic for the actual five tuple.
Examine subnet, NIC and AVNM effective rules, not only the edited rule file.
Verify the client resolves the service hostname to its approved private endpoint IP and can reach that private route.
Independently validate the private endpoint target's service authorization for the caller.
Grant all callers unrestricted data-plane access to compensate for an NSG allow rule that has not been checked against the private endpoint route.

Explanation

Correct Answer

From the workload, resolve the service FQDN to the intended private endpoint IP and test that the private path actually reaches that endpoint.

After private connectivity succeeds, the target service still evaluates the principal, RBAC/access policy or data-operation authorization; verify that permission independently.

Incorrect Answers

IP flow or connectivity diagnostics can help isolate a network block but do not confirm service-level operation permissions or the application’s private DNS resolution.

Effective NSG/AVNM rules are relevant network evidence, but a permitted packet is not proof of both private-endpoint DNS and data-plane authorization.

Granting every caller broad service permissions would bypass least privilege and cannot compensate for incorrect DNS or unreachable private routing.

Question 263

Microsoft 365 Copilot reveals executive files to ordinary internal users because the SharePoint site grants “Everyone except external users” access. Which change removes this SOURCE-SITE entitlement and proves Copilot no longer surfaces the files to an unauthorized employee?

Tighten SharePoint sharing/permissions at source and retest effective access.
Revoke anonymous sharing links on unrelated SharePoint sites but leave this executive site’s broad internal group grant unchanged.
Add a Copilot instruction to avoid executive information while leaving the site permissions unchanged.
Prioritize high-impact overshared sites and file permissions for remediation.

Explanation

Correct Answer

Remove the executive content’s excessive Everyone except external users entitlement, apply only approved audience membership, and retest the effective SharePoint access and Copilot retrieval as a non-executive.

Incorrect Answers

Removing unrelated anonymous links does not revoke this site’s Everyone except external users permission; internal users remain authorized to retrieve its content.

Prompt instructions cannot override existing SharePoint access rights. Unauthorized users must lose the source entitlement, not merely receive a requested model refusal.

Prioritizing overshared sites is inventory and triage; without changing this site’s grants it does not stop the observed unauthorized Copilot grounding.

Question 264

After a department transfer, a staff member still receives Copilot grounded answers from their FORMER team site through an inherited Microsoft 365 group membership. What should administrators correct first?

Revoke anonymous sharing URLs while leaving the transferred employee in their former team’s Microsoft 365 group.
Reassess inherited group memberships and content visibility for the new role.
Label the team documents Confidential without reviewing the employee’s inherited access.
Change the tenant-wide anonymous-sharing default but leave the employee’s inherited former-team membership untouched.

Explanation

Correct Answer

Review and remove obsolete group memberships and any inherited SharePoint site grants after the role change; test content access as that employee so Copilot loses the old entitlement.

Incorrect Answers

Revoking anonymous links addresses external link exposure, but the employee is still authorized through an internal inherited team group.

A sensitivity label alone does not remove a principal from the old team group; the access-control membership must be remediated.

Tenant sharing defaults do not automatically revoke an existing user’s inherited membership in a former team.

Question 265

Before an AI indexing rollout, an executive document has an active “Anyone with the link” sharing URL. Which FIRST remediation removes that uncontrolled link-based access without depending on Copilot behavior?

Keep the anonymous SharePoint sharing link active and rely only on a document sensitivity label to prevent Copilot retrieval.
Revoke broad links and apply least-privilege SharePoint access controls.
Add a Copilot response instruction to avoid the document but leave its existing “Anyone” link valid.
Exclude the document from a Copilot search experience while keeping its anonymous SharePoint URL accessible.

Explanation

Correct Answer

Revoke the Anyone link, replace it with explicit approved recipients or groups, and verify that unauthorized callers can no longer open the file.

Incorrect Answers

Sensitivity labels can impose policies, but merely retaining the anonymous URL while trusting its label is not proof of revoked external access.

A model instruction does not revoke the preexisting anonymous sharing token. Anyone possessing that URL could still retrieve content outside Copilot.

Hiding a document from one AI search path does not close its direct anonymous SharePoint URL; source sharing permissions remain exposed.

Question 266

A tenantwide SharePoint oversharing assessment finds dozens of highly sensitive sites with thousands of broadly authorized users. What is the best risk-based REMEDIATION PLAN for the assessment rather than a fix for one file?

Apply sensitivity labels to the flagged files without removing broad site groups or verifying who can read them.
Reassess inherited group memberships and content visibility for the new role.
Prioritize high-impact overshared sites and file permissions for remediation.
Revoke broad links and apply least-privilege SharePoint access controls.

Explanation

Correct Answer

Rank sensitive sites by data sensitivity, breadth of effective sharing and exposure, assign remediation owners, reduce broad grants, and verify the resulting access.

Incorrect Answers

Classification alone does not revoke inherited site grants or prove oversharing was reduced; access remediation and outcome checks are required.

Reviewing one employee’s former group memberships is useful for a transfer-specific exposure, but does not triage the tenantwide high-impact oversharing backlog.

Revoking selected anonymous links addresses a single sharing mechanism; the assessment also found excessive internal group access across many sites.

Question 267

A team adds a system-prompt rule telling Copilot not to reveal private records, yet the agent still reads an overshared SharePoint library. Which control actually ENFORCES the confidentiality boundary?

Enable Prompt Shields for suspicious text but leave the library’s overbroad SharePoint ACLs unchanged.
Remove anonymous links on an unrelated SharePoint site while keeping this private library’s broad internal group permissions.
Fix SharePoint ACLs and labels rather than relying on model refusal text.
Add a Copilot prompt instruction to ignore confidential files but leave the overbroad SharePoint site grants unchanged.

Explanation

Correct Answer

Correct source SharePoint ACLs and applicable sensitivity-label/DLP restrictions; prove the unauthorized principal cannot retrieve the record independently of Copilot’s prose.

Incorrect Answers

Prompt Shields address malicious input, not a legitimately authenticated principal who already holds overly broad SharePoint file permissions.

Revoking an unrelated site’s public links does not change the broad internal permissions on the library this agent uses to ground responses.

Additional model instructions are advisory and do not alter SharePoint effective permissions, so private content remains available to the overly broad audience.

Question 268

Security staff cannot determine which sensitive records employees are sharing with supported generative-AI apps. Which Microsoft Purview capability should they use FIRST to DISCOVER and investigate such data interactions?

Prioritize at-risk sources and enforce appropriate information protection and permissions.
Count AI application launches without collecting supported interaction and sensitive-information risk signals.
Assign risk owners and remediation workflow for DSPM findings.
Use Purview DSPM for AI visibility and investigate high-risk data interactions.

Explanation

Correct Answer

Use Microsoft Purview Data Security Posture Management/AI views with supported audit, classification and interaction signals to discover sensitive information being used in AI workflows, subject to coverage/licensing.

Incorrect Answers

Changing file permissions is an appropriate remediation after affected information and users are identified; it does not first establish visibility into AI data interactions.

A simple AI-app launch count cannot reveal what sensitive information was referenced, submitted or leaked in supported interactions.

Risk-owner assignment improves follow-through on known findings but does not create missing discovery or investigation telemetry.

Question 269

A security lead already sees AI-application inventory counts but asks WHICH supported Copilot interactions could expose sensitive information. Which analysis gives evidence beyond an app count?

Analyze risk findings and mapped policies rather than counting AI app launches only.
Assign risk owners and remediation workflow for DSPM findings.
Treat a one-time Copilot activity inventory as proof that no sensitive source content is overexposed, without checking policy coverage or permissions.
Use DSPM only to list AI app names and launch totals without inspecting interaction risk findings.

Explanation

Correct Answer

Examine supported DSPM/Purview interaction findings, sensitive-information classifications and policy matches; correlate to users and artifacts within the tenant’s enabled audit coverage.

Incorrect Answers

Assigning owners is a downstream response to confirmed risks, not the requested identification of which interactions are risky.

A one-time activity inventory without policy/permission context cannot establish that Copilot referenced only allowed sensitive files.

Inventory-only DSPM data identifies apps, not the risky interaction and policy context the security lead explicitly needs.

Question 270

DSPM findings identify confidential files exposed to broad internal groups. The team must REDUCE that existing source-data exposure, not merely report more AI usage. Which action addresses the findings?

Analyze risk findings and mapped policies rather than counting AI app launches only.
Use Purview DSPM for AI visibility and investigate high-risk data interactions.
Prioritize at-risk sources and enforce appropriate information protection and permissions.
Relabel the overshared documents confidential but leave anonymous and broad-group access unchanged.

Explanation

Correct Answer

Prioritize highly sensitive assets, narrow SharePoint permissions and links, apply appropriate information protection and DLP as supported, then verify effective access.

Incorrect Answers

Analyzing risk findings informs priorities, but does not change the grants that are exposing the confidential records.

DSPM discovery helps identify oversharing, but observation alone does not remove broad SharePoint access to confidential source documents.

A label without verified access controls does not automatically revoke the Everyone or Anyone sharing paths cited in the findings.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 25 - 10 Questions (Last Reviewed 20-Oct-2026)
Microsoft SC-500 Practice Test 26 - 10 Questions (Last Reviewed 19-Oct-2026)
Microsoft SC-500 Practice Test 27 - 10 Questions (Last Reviewed 18-Oct-2026)
Microsoft SC-500 Practice Test 28 - 10 Questions (Last Reviewed 17-Oct-2026)
Microsoft SC-500 Practice Test 29 - 10 Questions (Last Reviewed 16-Oct-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 260

Explanation

Correct Answer

Incorrect Answers

Question 261

Explanation

Correct Answer

Incorrect Answers

Question 262

Explanation

Correct Answer

Incorrect Answers

Question 263

Explanation

Correct Answer

Incorrect Answers

Question 264

Explanation

Correct Answer

Incorrect Answers

Question 265

Explanation

Correct Answer

Incorrect Answers

Question 266

Explanation

Correct Answer

Incorrect Answers

Question 267

Explanation

Correct Answer

Incorrect Answers

Question 268

Explanation

Correct Answer

Incorrect Answers

Question 269

Explanation

Correct Answer

Incorrect Answers

Question 270

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests