Microsoft SC-500 Practice Test 36

Question 350

A developer has Kubernetes cluster-admin to inspect application logs. Which response correctly handles this condition?

Assign narrow Kubernetes/Azure access roles and test effective permissions.
Apply network policies to permit only required pod-to-pod paths.
Restrict authorized API server network access or use a supported private cluster.
Use supported workload identities or managed secret paths, not static embedded credentials.

Explanation

Correct Answer

Give the developer only scoped Kubernetes logging permissions or Azure role access appropriate to their task, rather than cluster-admin privileges.

Incorrect Answers

Network policy controls pod traffic; it does not prevent an overprivileged human from modifying cluster resources through the API.

A private AKS API server limits network reach but does not remove cluster-admin from an already authenticated developer.

Workload identity replaces pod static credentials, which does not restrict this developer’s Kubernetes API RBAC for viewing logs.

Question 351

In AKS, one frontend pod can initiate connections to every service in unrelated namespaces. Which L3/L4 east-west policy restricts actual pod traffic?

Add namespace labels and assume they enforce east-west network isolation without a matching network policy.
Assign narrow Kubernetes/Azure access roles and test effective permissions.
Apply network policies to permit only required pod-to-pod paths.
Use supported workload identities or managed secret paths, not static embedded credentials.

Explanation

Correct Answer

Apply a supported Kubernetes NetworkPolicy (or relevant CNI policy) with namespace/pod selectors and explicit ingress/egress allows; verify unintended cross-namespace flows fail.

Incorrect Answers

Namespace metadata labels have no packet-filtering effect until a supported network policy engine uses them in enforcing policy.

RBAC controls Kubernetes API objects and commands, not automatically arbitrary TCP connections between pods.

Workload identity controls API credentials, not peer-to-peer data-plane packet acceptance among namespaces.

Question 352

An AKS Kubernetes API server is reachable from any public source even though management should be limited to corporate networks. Which control closes control-plane ingress?

Restrict authorized API server network access or use a supported private cluster.
Apply network policies to permit only required pod-to-pod paths.
Use supported workload identities or managed secret paths, not static embedded credentials.
Restrict local kubeconfig files while leaving the AKS API server reachable from unrestricted public networks.

Explanation

Correct Answer

Configure supported API authorized IP ranges or a private AKS cluster and enforce management access over approved private connectivity, verifying source restrictions.

Incorrect Answers

Pod-to-pod network policies control workload traffic and do not restrict the managed Kubernetes API server public endpoint.

Pod managed identities improve cloud-resource authentication but do not close unrestricted Kubernetes API network access.

Protecting kubeconfig files helps credentials but leaves the internet-reachable Kubernetes API endpoint open to probing.

Question 353

A Kubernetes image contains a plaintext Azure Container Registry pull password embedded at build time. Which redesign removes the long-lived credential from image layers?

Rotate a registry password embedded in the container image on every build instead of removing the embedded credential.
Restrict authorized API server network access or use a supported private cluster.
Use supported workload identities or managed secret paths, not static embedded credentials.
Assign narrow Kubernetes/Azure access roles and test effective permissions.

Explanation

Correct Answer

Use AKS/registry supported managed identity or workload identity for pull grants, or a protected Kubernetes secret when necessary; revoke the exposed password and rebuild clean images.

Incorrect Answers

Rotating and embedding the next registry password perpetuates credential exposure in image artifacts and build logs.

Restricting API server access affects control-plane visibility, not secrets already baked into distributable image layers.

Kubernetes RBAC for log inspection does not prevent container images from containing a leaked ACR credential.

Question 354

A CI pipeline uses Azure Container Registry’s shared administrator account for every build and runtime pull. Which identity change minimizes push/pull authority?

Scan images and deploy an approved immutable digest or version.
Apply appropriate private endpoint/network access restrictions.
Disable broad shared admin access and assign specific push/pull roles.
Scan the complete final image and update its base dependencies.

Explanation

Correct Answer

Disable the broad registry admin account and use independent pipeline/workload principals with minimum ACR push/pull data roles at appropriate repository scope.

Incorrect Answers

Immutable image digests protect deployment artifact identity, not the privilege scope of build authentication.

Private endpoint networking reduces exposure but does not revoke the shared admin credential or separate publisher and consumer permissions.

Image vulnerability scanning is important but cannot eliminate a reusable full-registry administrator password.

Question 355

AKS production pulls an ACR image by mutable :latest and a known vulnerable version reappears after the tag is moved. Which image admission/deployment method prevents unintended digest drift?

Scan images and deploy an approved immutable digest or version.
Disable broad shared admin access and assign specific push/pull roles.
Deploy the mutable latest image tag and assume it will always resolve to the last scanned and approved digest.
Apply appropriate private endpoint/network access restrictions.

Explanation

Correct Answer

Scan the complete resolved image and deploy its approved immutable digest or signed/pinned version, verifying running pods actually use it.

Incorrect Answers

Eliminating shared admin credentials does not ensure a still-mutable tag resolves to a patched image.

A mutable tag can resolve to a different image after the prior approval scan; the tag name itself is not immutable evidence.

Private registry ingress changes who can reach ACR; it does not constrain which artifact digest a permitted deployment chooses.

Question 356

A private CI/CD service is the only authorized consumer of Azure Container Registry, yet its public registry endpoint is accessible from the internet. Which network control is required?

Scan the complete final image and update its base dependencies.
Apply appropriate private endpoint/network access restrictions.
Require registry sign-in but keep its public endpoint enabled even though CI/CD is approved only over a private network.
Disable broad shared admin access and assign specific push/pull roles.

Explanation

Correct Answer

Configure eligible ACR private endpoint/DNS connectivity and disable or restrict public access as supported; test the intended private pipeline path.

Incorrect Answers

Image scanning identifies malicious/vulnerable content but cannot eliminate internet-side registry connectivity.

Authentication alone does not satisfy the specified private-network-only requirement; a public endpoint remains exposed.

Role separation controls authenticated push/pull operations but does not remove unnecessary public network reachability.

Question 357

A Dockerfile contains no obvious vulnerabilities, but its FROM image still includes a package with a confirmed CVE. What is the artifact-level remediation?

Apply appropriate private endpoint/network access restrictions.
Disable broad shared admin access and assign specific push/pull roles.
Rebuild the Dockerfile unchanged while continuing to pull the known vulnerable base-image digest.
Scan the complete final image and update its base dependencies.

Explanation

Correct Answer

Update the base image/package versions, rebuild, scan the resulting final artifact and redeploy the approved patched digest.

Incorrect Answers

Private networking protects registry traffic but cannot remove an exploitable package from the layered container image.

ACR push/pull privilege controls are unrelated to whether the image content carries inherited vulnerable packages.

Rebuilding unchanged against the same vulnerable digest leaves inherited vulnerable dependencies in the final image.

Question 358

An Azure Container App intended for internal service-to-service traffic has unauthenticated EXTERNAL ingress enabled. What configuration restores its network boundary?

Restrict ingress/access to approved internal paths.
Verify revision configuration and roll back the affected revision after security validation.
Replace with least-privilege workload identity or scoped secret where supported.
Use supported managed identity and secret references with scoped pull rights.

Explanation

Correct Answer

Set Container Apps ingress to internal/approved private connectivity and enforce appropriate authentication if required, then test that public calls cannot reach it.

Incorrect Answers

A revision rollback is appropriate when a specific deploy introduced a bad setting, but the required security target is private-only ingress, not simply choosing any prior revision.

Managed identity limits the app’s downstream resource permissions but does not disable its inbound internet listener.

Registry pull authorization protects image retrieval and is not a control on public HTTP ingress to the running application.

Question 359

An Azure Container App stores a long-lived ACR pull password as an environment variable. Which supported registry-authentication change removes or confines that credential?

Verify revision configuration and roll back the affected revision after security validation.
Restrict ingress/access to approved internal paths.
Use supported managed identity and secret references with scoped pull rights.
Give the container a storage-read identity but continue embedding the container-registry password in its environment variables.

Explanation

Correct Answer

Prefer the Container App’s supported managed identity with narrowly scoped ACR image-pull role; if unsupported use a protected secret reference, then revoke the exposed password.

Incorrect Answers

Rolling back a revision does not ensure the environment no longer contains the registry password in deployed configuration.

Ingress restrictions change who can connect to the app, not how it securely pulls private images.

Storage data permission is unrelated to ACR authentication, and leaving the registry password embedded maintains the exposure.

Question 360

An Azure Container Instance uses the storage ACCOUNT KEY to read one blob, granting access well beyond its task. Which credential replacement reduces the storage blast radius?

Verify revision configuration and roll back the affected revision after security validation.
Restrict ingress/access to approved internal paths.
Restrict registry image-pull permissions but continue using the broad storage account key for runtime data access.
Replace with least-privilege workload identity or scoped secret where supported.

Explanation

Correct Answer

Use the supported container workload managed identity plus narrowly scoped Blob data role where feasible, or a short-lived limited SAS/protected credential where identity is not supported; revoke the account key exposure.

Incorrect Answers

Container Apps revisions are a different service mechanism and do not address an Azure Container Instance’s storage credential.

Ingress access restrictions protect inbound traffic but cannot narrow a stolen shared storage account key’s data-plane authority.

ACR image-pull rights govern the registry, not runtime authorization to a storage account; the high-privilege account key still permits broad storage operations.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 34 - 10 Questions (Last Reviewed 11-Oct-2026)
Microsoft SC-500 Practice Test 35 - 10 Questions (Last Reviewed 10-Oct-2026)
Microsoft SC-500 Practice Test 36 - 10 Questions (Last Reviewed 09-Oct-2026)
Microsoft SC-500 Practice Test 37 - 10 Questions (Last Reviewed 08-Oct-2026)
Microsoft SC-500 Practice Test 38 - 10 Questions (Last Reviewed 07-Oct-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 350

Explanation

Correct Answer

Incorrect Answers

Question 351

Explanation

Correct Answer

Incorrect Answers

Question 352

Explanation

Correct Answer

Incorrect Answers

Question 353

Explanation

Correct Answer

Incorrect Answers

Question 354

Explanation

Correct Answer

Incorrect Answers

Question 355

Explanation

Correct Answer

Incorrect Answers

Question 356

Explanation

Correct Answer

Incorrect Answers

Question 357

Explanation

Correct Answer

Incorrect Answers

Question 358

Explanation

Correct Answer

Incorrect Answers

Question 359

Explanation

Correct Answer

Incorrect Answers

Question 360

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests