Microsoft SC-500 Practice Test 5

Question 40

Before a multitenant application is approved, it REQUESTS excessive tenant-wide API permissions during onboarding. What security review should happen before any consent is granted?

Review tenant consent, requested API permissions and publisher trust before authorizing access.
Review application consent and enterprise application creation rather than granting a human admin login.
Distinguish application permissions from delegated-user permissions and revoke excess application grants.
Revoke the exposed secret and adopt managed/workload identity or protected credential storage.

Explanation

Correct Answer

Inspect the publisher and the precise delegated/app-only API scopes; refuse broad permissions unless the approved workload genuinely needs them.

Incorrect Answers

Creating an enterprise application is part of onboarding, not permission-level assurance when the request asks for high-impact scopes.

Revoking existing app grants is a later response if improper access was already approved; the first preventive step is to validate the requested multi-tenant consent.

Rotating a client secret does not reduce newly requested tenant-wide authorization scope during onboarding.

Question 41

A third-party app asks ordinary employees to consent to high-impact read-write directory permissions. Select TWO consent-policy controls that prevent an unreviewed end-user grant and require authorized review before approval.

Approve every delegated permission because delegated scopes always inherit sufficient safety from the signed-in user.
Revoke consent and credentials, investigate grants and rotate impacted access.
Require a documented administrator-consent review before granting sensitive OAuth scopes.
Inventory service principals and permission-grant records, not only user accounts.
Restrict end-user consent for the application's high-impact directory permissions.

Explanation

Correct Answer

Use the administrator consent workflow to require authorized review of requested sensitive permissions before an administrator authorizes the grant.

An end-user consent policy should disallow approval of the high-impact directory permissions by ordinary employees; otherwise an unreviewed OAuth grant could be created.

Incorrect Answers

Delegated permissions still let the app act with the user’s authorized data and can carry substantial risk; they are not automatically safe for unrestricted employee consent.

Revocation and incident investigation address a compromised grant, not the prospective approval of a new grant.

Inventorying service principals reveals existing app grants, but does not by itself stop employees approving new high-risk delegated scopes.

Question 42

An application claims it only reads the signed-in user's profile but asks for tenant-wide app permissions. Which change most directly addresses the described security requirement?

Revoke consent and credentials, investigate grants and rotate impacted access.
Replace broad grants with task-specific permissions and verify least-privilege operation.
Compare requested delegated versus application grants before approval.
Restrict user consent and require a review or admin consent workflow for high-impact scopes.

Explanation

Correct Answer

An app claiming to read only a signed-in user profile should use appropriately scoped delegated permissions; app-only tenant-wide rights need explicit risk review before consent.

Incorrect Answers

Revoking credentials is incident response when a grant was compromised, not the necessary preapproval comparison for this request.

Replacing broad scopes is a good eventual adjustment, but compare delegated versus application permission types first to decide what is being requested.

Administrator consent workflow adds approval controls; it does not itself determine whether the requested app-only rights exceed the claimed user-profile use.

Question 43

A once-approved OAuth app is compromised and starts reading excessive mail. Which action should be selected for this deployment?

Inventory service principals and permission-grant records, not only user accounts.
Compare requested delegated versus application grants before approval.
Restrict user consent and require a review or admin consent workflow for high-impact scopes.
Revoke consent and credentials, investigate grants and rotate impacted access.

Explanation

Correct Answer

Revoke implicated app grants/credentials, investigate the service principal and audit access, and rotate exposed dependent credentials to stop ongoing mail access.

Incorrect Answers

Inventorying service principals identifies candidate grants but does not suspend the compromised app or invalidate its credentials.

Comparing delegated and application scopes is diagnostic only until the compromised authorization is actually revoked.

Prospective user-consent restrictions will reduce future risky grants but do not disable the already compromised application.

Question 44

A security auditor wants to find apps granted consent by departed administrators. Which remediation is the most relevant for this failure?

Restrict user consent and require a review or admin consent workflow for high-impact scopes.
Compare requested delegated versus application grants before approval.
Replace broad grants with task-specific permissions and verify least-privilege operation.
Inventory service principals and permission-grant records, not only user accounts.

Explanation

Correct Answer

Enumerate enterprise app service principals, delegated OAuth2 grants and application role assignments; verify owner/consent history after employee departure.

Incorrect Answers

Blocking new user consent does not enumerate old service-principal and OAuth grant objects associated with departed administrators.

A preapproval scope comparison addresses a new request, not an audit of previously granted permissions in the tenant.

Replacing broad permissions would modify affected apps but cannot discover all consent grants made by former staff without inventory.

Question 45

An integration needs one narrow Graph scope but requests all directory permissions. What should the security engineer do first to resolve this case?

Replace broad grants with task-specific permissions and verify least-privilege operation.
Restrict user consent and require a review or admin consent workflow for high-impact scopes.
Approve Directory.ReadWrite.All for the integration, then plan a later review instead of granting only the Graph scope the workflow needs.
Inventory service principals and permission-grant records, not only user accounts.

Explanation

Correct Answer

Grant only the narrowly required Microsoft Graph delegated scope or app role, remove Directory.ReadWrite.All and verify operations under the reduced permission set.

Incorrect Answers

Requiring admin consent does not make an unnecessarily expansive Directory.ReadWrite.All grant least privilege.

Approving tenant-wide directory write rights now still exposes unrelated users and objects, even if a future review is planned.

Inventorying principals can reveal the broad grant but does not reduce the authorization it currently carries.

Question 46

An Azure Function uses a hardcoded Key Vault credential in configuration. Which control would most directly close the security gap?

Assign the necessary Storage data-plane permission at the correct scope.
Enable managed identity, assign minimum Key Vault data-plane role and remove stored secret.
Diagnose data-plane authorization and resource/firewall rules rather than replacing identity with an account key.
Reapply appropriate role assignments to the replacement principal or use a suitably governed user-assigned identity.

Explanation

Correct Answer

Enable the Function managed identity, give its principal only the needed Key Vault data-plane access, and remove the stored vault credential from configuration.

Incorrect Answers

Storage Blob data permission does not authorize Key Vault secret reads or remove a hardcoded Key Vault secret.

Diagnosing a 403 presupposes that an identity has a valid token; it does not remove the workload’s existing stored credential.

Replacing a managed identity principal addresses a resource recreation problem, not the initial hardcoded secret embedded in this Function.

Question 47

A system-assigned managed identity is deleted when its app is redeployed under a new resource ID. What is the best next security action?

Enable managed identity, assign minimum Key Vault data-plane role and remove stored secret.
Assign the necessary Storage data-plane permission at the correct scope.
Reapply appropriate role assignments to the replacement principal or use a suitably governed user-assigned identity.
Separate workload identities to limit blast radius and audit effective permissions.

Explanation

Correct Answer

A new resource identity has a new principal/object ID. Reassign required roles to it or use a governed user-assigned identity whose lifecycle survives resource replacement.

Incorrect Answers

Turning managed identity on again does not automatically recreate Azure RBAC assignments attached to the old deleted principal.

Granting Storage data access only helps if that is the lost permission and it is assigned to the actual new principal; the general repair is identity reassignment.

Identity separation can limit future blast radius but does not restore role assignments lost with the deleted system-assigned identity principal.

Question 48

Several container applications need the same reusable service identity across replacements. Which control best addresses the actual risk described?

Diagnose data-plane authorization and resource/firewall rules rather than replacing identity with an account key.
Consider a user-assigned managed identity with precise resource assignments and lifecycle ownership.
Separate workload identities to limit blast radius and audit effective permissions.
Assign the necessary Storage data-plane permission at the correct scope.

Explanation

Correct Answer

A governed user-assigned managed identity exists independently of each container resource, and can be attached with scoped RBAC and deliberate ownership.

Incorrect Answers

Investigating firewall or data-plane 403 errors is unrelated to selecting an identity with a stable lifecycle across container replacements.

Separate identities reduce blast radius but do not meet the stated requirement for one intentionally shared reusable principal across replacements.

Granting a Storage data role to an unrelated principal does not provide a reusable identity across the replacing container applications.

Question 49

A managed identity already authenticates to Azure Storage, but its only current role is Azure resource Contributor and no blob data-reader permission has been assigned. Which specific access grant is missing for blob reads?

Diagnose data-plane authorization and resource/firewall rules rather than replacing identity with an account key.
Assign the necessary Storage data-plane permission at the correct scope.
Consider a user-assigned managed identity with precise resource assignments and lifecycle ownership.
Enable managed identity, assign minimum Key Vault data-plane role and remove stored secret.

Explanation

Correct Answer

Azure Contributor typically manages the storage account control plane; the principal needs a Storage Blob Data Reader or equivalent scoped data action to read the blob.

Incorrect Answers

Inspecting firewall and data roles is reasonable diagnosis, but the stated gap is missing data-plane authorization despite a control-plane Contributor grant.

Changing identity lifecycle to user-assigned does not grant blob read to an existing principal by itself.

Granting Key Vault data access would authorize secrets, not blob contents in Azure Storage.

Question 50

An Azure Function obtains a Microsoft Entra token for its managed identity, but reading a Key Vault secret returns HTTP 403. An engineer proposes replacing identity-based access with a stored credential. What should the security engineer check FIRST?

Separate workload identities to limit blast radius and audit effective permissions.
Enable managed identity, assign minimum Key Vault data-plane role and remove stored secret.
Consider a user-assigned managed identity with precise resource assignments and lifecycle ownership.
Check the Function’s effective managed-identity principal, Key Vault secret data-plane role and vault network restrictions before changing authentication methods.

Explanation

Correct Answer

After token acquisition succeeds, check the actual principal, the vault authorization model and secret-read role/permissions, plus vault firewall/private link settings causing 403.

Incorrect Answers

Identity separation may reduce cross-service exposure but cannot diagnose the specific Key Vault data-plane 403.

Enabling the already working managed identity again does not prove the vault recognizes its principal or that network access is allowed.

Choosing user-assigned instead of system-assigned identity would not correct missing secret data permissions or a blocked Key Vault network path.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 3 - 10 Questions (Last Reviewed 11-Nov-2026)
Microsoft SC-500 Practice Test 4 - 10 Questions (Last Reviewed 10-Nov-2026)
Microsoft SC-500 Practice Test 5 - 10 Questions (Last Reviewed 09-Nov-2026)
Microsoft SC-500 Practice Test 6 - 10 Questions (Last Reviewed 08-Nov-2026)
Microsoft SC-500 Practice Test 7 - 10 Questions (Last Reviewed 07-Nov-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 40

Explanation

Correct Answer

Incorrect Answers

Question 41

Explanation

Correct Answer

Incorrect Answers

Question 42

Explanation

Correct Answer

Incorrect Answers

Question 43

Explanation

Correct Answer

Incorrect Answers

Question 44

Explanation

Correct Answer

Incorrect Answers

Question 45

Explanation

Correct Answer

Incorrect Answers

Question 46

Explanation

Correct Answer

Incorrect Answers

Question 47

Explanation

Correct Answer

Incorrect Answers

Question 48

Explanation

Correct Answer

Incorrect Answers

Question 49

Explanation

Correct Answer

Incorrect Answers

Question 50

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests