Microsoft SC-500 Practice Test 3

Question 20

A policy protects all users but inadvertently includes emergency access identities. Which response correctly handles this condition?

Define reviewed emergency-account exclusions and monitor their use.
Evaluate the policy with report-only and What If before enabling enforcement.
Evaluate guest/external-user inclusion and target-resource scope rather than assuming universal coverage.
Create an appropriate legacy-client Conditional Access block policy and verify sign-in logs.

Explanation

Correct Answer

Use carefully scoped emergency-access account exclusions, control their credentials and alert on every exceptional sign-in so recovery remains possible.

Incorrect Answers

What If can expose lockout before rollout, but does not itself exclude a separately protected emergency identity from an enforced policy.

Guest-user targeting addresses external identities rather than the designated emergency accounts that must remain usable during normal-policy failure.

Blocking legacy clients is an independent hardening measure; it does not prevent the broad policy from trapping emergency recovery accounts.

Question 21

A trusted office location exception stops working after outbound IP changes. Which implementation decision is most appropriate here?

Define reviewed emergency-account exclusions and monitor their use.
Check the actual named location public IP ranges used by sign-ins.
Interpret the configured AND/OR grant operator and satisfy both required controls.
Create an appropriate legacy-client Conditional Access block policy and verify sign-in logs.

Explanation

Correct Answer

Inspect the public IP in the actual Entra sign-in and match it against the configured named location; update the allowed range using authorized change control.

Incorrect Answers

Break-glass account exclusions address emergency recovery identities, not whether this office’s observed source address still belongs to a trusted named location.

Grant-control AND/OR evaluation determines which authentication/device checks apply, not whether an updated office IP is recognized as trusted.

Blocking legacy authentication clients would not update the named-location IP range after the office changes its public egress address.

Question 22

A user meets MFA but fails a policy requiring MFA AND a compliant device. Which change most directly addresses the described security requirement?

Scope Conditional Access to the relevant identity, application and compliant-device control.
Interpret the configured AND/OR grant operator and satisfy both required controls.
Evaluate guest/external-user inclusion and target-resource scope rather than assuming universal coverage.
Create an appropriate legacy-client Conditional Access block policy and verify sign-in logs.

Explanation

Correct Answer

With “require all selected controls,” passing MFA alone cannot grant access: the device must separately satisfy the compliant-device requirement.

Incorrect Answers

Adding another compliant-device policy is not necessary if the enforcing policy already requires compliance; inspect and remediate the device state.

Guest identity inclusion is unrelated because the scenario already identifies the failing compliance grant for the current user.

A legacy-client block does not satisfy the compliant-device condition for this already evaluated modern sign-in.

Question 23

A workload is accessible by guest users but the policy targets only employees. Which action should be selected for this deployment?

Evaluate the policy with report-only and What If before enabling enforcement.
Interpret the configured AND/OR grant operator and satisfy both required controls.
Define reviewed emergency-account exclusions and monitor their use.
Evaluate guest/external-user inclusion and target-resource scope rather than assuming universal coverage.

Explanation

Correct Answer

Review the guest/external identity inclusion and the target application/resource of the policy; correct the missing guest scope and verify actual sign-ins.

Incorrect Answers

Testing in report-only is useful before enforcement, but a policy scoped to employees still does not cover guest sign-ins without assignment changes.

Combining MFA and compliant-device grants does not compensate for a user category that was never assigned to the Conditional Access policy.

Emergency account exceptions keep recovery access possible; they do not extend protection to unaddressed business-to-business guests.

Question 24

A remote engineer was blocked immediately after Conditional Access policies changed. Select TWO diagnostic checks that identify the actual policy and failed grant requirement for this sign-in before any exception is proposed.

Inspect the specific grant condition that failed for the engineer's identity and resource.
Recognize report-only evaluation does not enforce the block; review impact before enabling.
Inspect the failed sign-in record to identify which Conditional Access policies applied.
Correct target-resource assignments rather than assuming tenant-wide protection.
Retry MFA prompts until sign-in succeeds without checking the new device-compliance or resource grant requirement.

Explanation

Correct Answer

Inspect the Conditional Access details of the failed sign-in to determine which grant control (for example device compliance) was not satisfied.

The sign-in record lists the Conditional Access policies evaluated and their resulting states, identifying the actual enforcement path.

Incorrect Answers

Report-only outcomes are worth reviewing during rollout, but a report-only policy does not enforce the observed block. This does not identify the enforcing failure.

Changing application targeting without evidence risks weakening protection. The first task is to identify which evaluated policy and grant condition caused this denial.

Repeating MFA cannot identify the policy that denied the sign-in; an unmet device-compliance requirement would remain unmet.

Question 25

A Conditional Access policy in Report-only status predicts this sign-in would be blocked, but the user still enters the app. What explains the successful sign-in, and what should occur before enforcement?

Recognize report-only evaluation does not enforce the block; review impact before enabling.
Apply named-location/risk signals and test policy precedence for those contexts.
Inspect sign-in logs for applied policy and failed grant conditions.
Diagnose device state and compliance grant instead of repeatedly prompting for MFA.

Explanation

Correct Answer

Report-only evaluates sign-ins without applying the block. Confirm impact, then deliberately switch the reviewed policy to On when enforcement is intended.

Incorrect Answers

Named-location changes do not explain why a report-only policy predicts a block but does not actually enforce it.

Sign-in logs can show the report-only prediction, but inspecting them alone will not convert that result into a real access block.

Device-compliance troubleshooting is relevant to a real failed grant, not an access attempt that succeeds under report-only evaluation.

Question 26

A policy targets one app but a second enterprise app remains accessible. Which control would most directly close the security gap?

Recognize report-only evaluation does not enforce the block; review impact before enabling.
Apply named-location/risk signals and test policy precedence for those contexts.
Correct target-resource assignments rather than assuming tenant-wide protection.
Inspect sign-in logs for applied policy and failed grant conditions.

Explanation

Correct Answer

Conditional Access does not implicitly extend one app assignment to all enterprise apps; include the second target resource and confirm its effective policy evaluation.

Incorrect Answers

Report-only behavior is unrelated if the first app is being enforced correctly while the second is simply out of scope.

Network risk signals affect conditional behavior for already targeted resources; they cannot include a separate enterprise app that the rule omits.

Sign-in records help prove the second app was not targeted, but reviewing them without updating resource assignment does not close the exposure.

Question 27

A user reauthenticates successfully but a sign-in still fails device compliance. What is the best next security action?

Diagnose device state and compliance grant instead of repeatedly prompting for MFA.
Correct target-resource assignments rather than assuming tenant-wide protection.
Recognize report-only evaluation does not enforce the block; review impact before enabling.
Apply named-location/risk signals and test policy precedence for those contexts.

Explanation

Correct Answer

Inspect the device compliance and registration state and the policy grant details; successful MFA cannot satisfy a separate required compliant-device condition.

Incorrect Answers

Changing app targeting cannot satisfy the device-compliance grant that the sign-in already evaluated and failed.

Report-only policy predictions do not explain a genuine enforced compliant-device failure on this already evaluated session.

Changing location policy criteria would not make an out-of-compliance endpoint meet the explicit device requirement.

Question 28

A sign-in from a high-risk location needs different access controls than a trusted network. Which control best addresses the actual risk described?

Recognize report-only evaluation does not enforce the block; review impact before enabling.
Treat the office named-location exception as a global permission to admit every risky-location sign-in without evaluating source IP or policy scope.
Apply named-location/risk signals and test policy precedence for those contexts.
Correct target-resource assignments rather than assuming tenant-wide protection.

Explanation

Correct Answer

Use observed public source IP, named-location conditions and available sign-in risk controls, then confirm how the policy applies in each context.

Incorrect Answers

Report-only testing cannot classify the current risky-location sign-in or enforce the intended location-dependent restrictions.

A trusted office exclusion is scoped to its configured locations and identities; it cannot override every policy for unrelated high-risk IP addresses.

Changing app assignments does not address the difference between a trusted named location and a risky network source for the same app.

Question 29

Phishing-resistant authentication is required for privileged operators because attackers have defeated password-plus-SMS OTP. Which SPECIFIC sign-in credential approach meets that requirement?

Check the specific grant control and authentication-strength satisfaction in the sign-in record.
Stage method migration with verified enrollment, exclusions and fallback recovery before enforcement.
Restrict allowed methods and require appropriate strengths for privileged resources.
Prefer phishing-resistant FIDO2 or certificate-based methods with an appropriate authentication strength.

Explanation

Correct Answer

FIDO2/passkeys and supported certificate-based authentication with a matching authentication strength resist the phishable SMS OTP flow described.

Incorrect Answers

Checking sign-in records identifies the method used but does not name a replacement credential with phishing resistance.

A staged migration may reduce disruption, but it does not identify the required credential type.

An authentication-method policy can restrict permitted methods, but does not by itself identify the specific phishing-resistant credential requested.

Question 30

A staff member enrolls a new authenticator without proving control of an allowed registration process. Which response correctly handles this condition?

Protect authentication-method registration and review registration events.
Restrict allowed methods and require appropriate strengths for privileged resources.
Check the specific grant control and authentication-strength satisfaction in the sign-in record.
Configure an applicable passkey or supported passwordless method and confirm registration and sign-in policy.

Explanation

Correct Answer

Protect registration with approved proofing/Conditional Access controls and review registration events; otherwise an attacker could enroll an authenticator without satisfying required registration checks.

Incorrect Answers

Disabling weak methods limits method choice, but does not resolve that registration is occurring without the intended proof of identity.

Sign-in grant diagnostics concern application access after enrollment, not the assurance of a new authentication-method registration event.

Enabling passkeys can strengthen future sign-ins, but registration still needs an authorized, verified enrollment process.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 1 - 10 Questions (Last Reviewed 13-Nov-2026)
Microsoft SC-500 Practice Test 2 - 10 Questions (Last Reviewed 12-Nov-2026)
Microsoft SC-500 Practice Test 3 - 10 Questions (Last Reviewed 11-Nov-2026)
Microsoft SC-500 Practice Test 4 - 10 Questions (Last Reviewed 10-Nov-2026)
Microsoft SC-500 Practice Test 5 - 10 Questions (Last Reviewed 09-Nov-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 20

Explanation

Correct Answer

Incorrect Answers

Question 21

Explanation

Correct Answer

Incorrect Answers

Question 22

Explanation

Correct Answer

Incorrect Answers

Question 23

Explanation

Correct Answer

Incorrect Answers

Question 24

Explanation

Correct Answer

Incorrect Answers

Question 25

Explanation

Correct Answer

Incorrect Answers

Question 26

Explanation

Correct Answer

Incorrect Answers

Question 27

Explanation

Correct Answer

Incorrect Answers

Question 28

Explanation

Correct Answer

Incorrect Answers

Question 29

Explanation

Correct Answer

Incorrect Answers

Question 30

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests