Microsoft SC-500 Practice Test 4

Question 30

A staff member enrolls a new authenticator without proving control of an allowed registration process. Which response correctly handles this condition?

Protect authentication-method registration and review registration events.
Restrict allowed methods and require appropriate strengths for privileged resources.
Check the specific grant control and authentication-strength satisfaction in the sign-in record.
Configure an applicable passkey or supported passwordless method and confirm registration and sign-in policy.

Explanation

Correct Answer

Protect registration with approved proofing/Conditional Access controls and review registration events; otherwise an attacker could enroll an authenticator without satisfying required registration checks.

Incorrect Answers

Disabling weak methods limits method choice, but does not resolve that registration is occurring without the intended proof of identity.

Sign-in grant diagnostics concern application access after enrollment, not the assurance of a new authentication-method registration event.

Enabling passkeys can strengthen future sign-ins, but registration still needs an authorized, verified enrollment process.

Question 31

An application expects MFA but its sign-in reports a single-factor session. Which implementation decision is most appropriate here?

Protect authentication-method registration and review registration events.
Configure an applicable passkey or supported passwordless method and confirm registration and sign-in policy.
Check the specific grant control and authentication-strength satisfaction in the sign-in record.
Prefer phishing-resistant FIDO2 or certificate-based methods with an appropriate authentication strength.

Explanation

Correct Answer

Inspect this sign-in’s Conditional Access results, effective MFA/authentication-strength grant and the authentication details to determine what was actually satisfied.

Incorrect Answers

Controlling new authenticator enrollment protects registration but does not establish this particular app’s configured sign-in grant.

Offering another passwordless method may be a remediation after diagnosis, but cannot establish why the current session lacked the expected MFA result.

Choosing a stronger credential without examining this application’s applied grant policy does not explain why a specific session was recorded as single-factor.

Question 32

An administrator loses a hardware security key before a production incident. Which change most directly addresses the described security requirement?

Stage method migration with verified enrollment, exclusions and fallback recovery before enforcement.
Use an approved recovery method and enforce identity proofing, not bypass MFA for the entire role.
Protect authentication-method registration and review registration events.
Restrict allowed methods and require appropriate strengths for privileged resources.

Explanation

Correct Answer

Verify the administrator through an approved recovery process such as time-limited Temporary Access Pass where appropriate; revoke the lost key, register a replacement and keep privileged authentication protection.

Incorrect Answers

A bulk method-migration rollout does not replace the immediate, identity-verified recovery and credential revocation required for one lost physical key.

Tightening registration policy is good hygiene but does not alone prove this locked-out administrator is legitimate or restore access safely.

Requiring phishing-resistant methods for everyone can improve policy, but cannot safely recover this individual administrator after the registered security key was lost.

Question 33

A mobile workforce needs passwordless sign-in with strong user verification. Which choice actually CONFIGURES a supported passwordless method and its sign-in/registration policy, rather than only diagnosing or planning rollout?

Check the specific grant control and authentication-strength satisfaction in the sign-in record.
Configure an applicable passkey or supported passwordless method and confirm registration and sign-in policy.
Restrict allowed methods and require appropriate strengths for privileged resources.
Stage method migration with verified enrollment, exclusions and fallback recovery before enforcement.

Explanation

Correct Answer

Enable appropriate passkeys/FIDO2 or supported passwordless methods, configure targeted registration/sign-in rules and verify strong user verification on managed endpoints.

Incorrect Answers

Reviewing authentication-strength details in sign-in logs diagnoses an existing session rather than enrolling the workforce in passwordless sign-in.

Restricting a set of allowed methods is not a concrete passwordless registration and sign-in implementation for the mobile users.

Staging migration controls rollout risk, but does not itself configure the supported passwordless credential or its registration policy.

Question 34

A privileged application already requires phishing-resistant sign-in, but the tenant STILL lets users register weaker authentication methods. Which policy change addresses the weak-method registration exposure?

Protect authentication-method registration and review registration events.
Configure an applicable passkey or supported passwordless method and confirm registration and sign-in policy.
Prefer phishing-resistant FIDO2 or certificate-based methods with an appropriate authentication strength.
Restrict allowed methods and require appropriate strengths for privileged resources.

Explanation

Correct Answer

Limit registration of disallowed methods using the Entra authentication methods policy while keeping the separate privileged application’s existing sign-in strength enforced.

Incorrect Answers

Reviewing registration events detects enrollment activity but does not itself prevent registration of a prohibited weak method.

Allowing passkeys alone does not prevent a user from enrolling a weaker method that remains permitted in the tenant.

Phishing-resistant credential guidance repeats the already-enforced application requirement; it does not narrow tenant-wide enrollment permissions.

Question 35

A deployment change from SMS to passkeys breaks some registered devices. What should the security engineer do first to resolve this case?

Restrict allowed methods and require appropriate strengths for privileged resources.
Prefer phishing-resistant FIDO2 or certificate-based methods with an appropriate authentication strength.
Use an approved recovery method and enforce identity proofing, not bypass MFA for the entire role.
Stage method migration with verified enrollment, exclusions and fallback recovery before enforcement.

Explanation

Correct Answer

Pilot method readiness, check existing enrollment, test supported device/browser scenarios and provide approved recovery before disabling SMS for each affected group.

Incorrect Answers

Disabling weak methods immediately can strand users whose device cannot yet register an allowed passkey; confirm readiness first.

Naming a stronger credential does not repair enrollment failures or supply recovery for devices that cannot support the migration.

Per-user recovery after a lost hardware key does not address a fleet-wide passkey registration and device-compatibility rollout problem.

Question 36

A vendor SaaS app needs access to this tenant but no tenant-local service principal exists. Which control would most directly close the security gap?

Review application consent and enterprise application creation rather than granting a human admin login.
Distinguish application permissions from delegated-user permissions and revoke excess application grants.
Correct app registration resource/scope and validate token audience before calling the API.
Approve the vendor’s requested tenant-wide API permissions before establishing its tenant-local enterprise application and consent scope.

Explanation

Correct Answer

Review the multitenant application publisher and permissions; authorize appropriate consent to establish its service principal/enterprise app in this tenant without sharing a human admin account.

Incorrect Answers

Reviewing delegated versus application permissions matters after the tenant-local enterprise app exists; it does not create the missing service principal for onboarding.

Token audience troubleshooting assumes an app and API request have already been configured; the immediate gap is tenant-side application onboarding.

Granting broad tenant-wide consent before inspecting the app and requested scopes reverses the trust review and may authorize unnecessary access.

Question 37

An API resource rejects tokens because the application uses the wrong audience. What is the best next security action?

Review tenant consent, requested API permissions and publisher trust before authorizing access.
Review application consent and enterprise application creation rather than granting a human admin login.
Correct app registration resource/scope and validate token audience before calling the API.
Distinguish application permissions from delegated-user permissions and revoke excess application grants.

Explanation

Correct Answer

The access token aud claim must identify the intended API. Request a token for the correct resource/scopes and validate issuer/audience on the API.

Incorrect Answers

Publisher/consent review is valuable for permissions, but an API rejecting the wrong audience needs token resource correction.

Recreating a service principal would not change an access token issued for the wrong resource identifier.

Revoking application grants addresses excessive authorization, not a token whose intended audience does not match the receiving API.

Question 38

A daemon uses a client secret committed to a shared repository. Which control best addresses the actual risk described?

Review application consent and enterprise application creation rather than granting a human admin login.
Revoke the exposed secret and adopt managed/workload identity or protected credential storage.
Correct app registration resource/scope and validate token audience before calling the API.
Distinguish application permissions from delegated-user permissions and revoke excess application grants.

Explanation

Correct Answer

Revoke and rotate the leaked app credential immediately; replace embedded secrets with managed identity, workload federation or protected credential handling appropriate to the daemon.

Incorrect Answers

Enterprise-app onboarding does not invalidate the already exposed confidential-client secret in the repository.

Changing API audience repairs token targeting but not theft of a credential committed to source code.

Narrowing Graph grants limits reach, but the compromised client secret remains usable until it is revoked and replaced.

Question 39

A line-of-business application was scheduled for DECOMMISSIONING when its original employee owner left, yet it still obtains APP-ONLY access tokens without user sign-in. Which check and authorization remediation best closes the orphaned tenant access?

Review tenant consent, requested API permissions and publisher trust before authorizing access.
Revoke the exposed secret and adopt managed/workload identity or protected credential storage.
Distinguish application permissions from delegated-user permissions and revoke excess application grants.
Correct app registration resource/scope and validate token audience before calling the API.

Explanation

Correct Answer

Application permissions act as the service principal independently of the departed user. Review and revoke excessive app grants or credentials, and distinguish these from delegated sign-in grants.

Incorrect Answers

A new publisher/tenant-consent review does not explain why an existing service continues obtaining app-only tokens after the former employee is disabled.

Secret rotation alone does not determine whether app-only permissions should still exist; authorization grants and identity lifecycle must also be reviewed.

Changing token audience may alter the resource being called but does not terminate an unnecessary application permission grant.

Question 40

Before a multitenant application is approved, it REQUESTS excessive tenant-wide API permissions during onboarding. What security review should happen before any consent is granted?

Review tenant consent, requested API permissions and publisher trust before authorizing access.
Review application consent and enterprise application creation rather than granting a human admin login.
Distinguish application permissions from delegated-user permissions and revoke excess application grants.
Revoke the exposed secret and adopt managed/workload identity or protected credential storage.

Explanation

Correct Answer

Inspect the publisher and the precise delegated/app-only API scopes; refuse broad permissions unless the approved workload genuinely needs them.

Incorrect Answers

Creating an enterprise application is part of onboarding, not permission-level assurance when the request asks for high-impact scopes.

Revoking existing app grants is a later response if improper access was already approved; the first preventive step is to validate the requested multi-tenant consent.

Rotating a client secret does not reduce newly requested tenant-wide authorization scope during onboarding.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 2 - 10 Questions (Last Reviewed 12-Nov-2026)
Microsoft SC-500 Practice Test 3 - 10 Questions (Last Reviewed 11-Nov-2026)
Microsoft SC-500 Practice Test 4 - 10 Questions (Last Reviewed 10-Nov-2026)
Microsoft SC-500 Practice Test 5 - 10 Questions (Last Reviewed 09-Nov-2026)
Microsoft SC-500 Practice Test 6 - 10 Questions (Last Reviewed 08-Nov-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 30

Explanation

Correct Answer

Incorrect Answers

Question 31

Explanation

Correct Answer

Incorrect Answers

Question 32

Explanation

Correct Answer

Incorrect Answers

Question 33

Explanation

Correct Answer

Incorrect Answers

Question 34

Explanation

Correct Answer

Incorrect Answers

Question 35

Explanation

Correct Answer

Incorrect Answers

Question 36

Explanation

Correct Answer

Incorrect Answers

Question 37

Explanation

Correct Answer

Incorrect Answers

Question 38

Explanation

Correct Answer

Incorrect Answers

Question 39

Explanation

Correct Answer

Incorrect Answers

Question 40

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests