Microsoft SC-500 Practice Test 6

Question 50

An Azure Function obtains a Microsoft Entra token for its managed identity, but reading a Key Vault secret returns HTTP 403. An engineer proposes replacing identity-based access with a stored credential. What should the security engineer check FIRST?

Separate workload identities to limit blast radius and audit effective permissions.
Enable managed identity, assign minimum Key Vault data-plane role and remove stored secret.
Consider a user-assigned managed identity with precise resource assignments and lifecycle ownership.
Check the Function’s effective managed-identity principal, Key Vault secret data-plane role and vault network restrictions before changing authentication methods.

Explanation

Correct Answer

After token acquisition succeeds, check the actual principal, the vault authorization model and secret-read role/permissions, plus vault firewall/private link settings causing 403.

Incorrect Answers

Identity separation may reduce cross-service exposure but cannot diagnose the specific Key Vault data-plane 403.

Enabling the already working managed identity again does not prove the vault recognizes its principal or that network access is allowed.

Choosing user-assigned instead of system-assigned identity would not correct missing secret data permissions or a blocked Key Vault network path.

Question 51

A pipeline accidentally shares one managed identity across unrelated high-risk services. Which implementation decision is most appropriate here?

Reapply appropriate role assignments to the replacement principal or use a suitably governed user-assigned identity.
Consider a user-assigned managed identity with precise resource assignments and lifecycle ownership.
Separate workload identities to limit blast radius and audit effective permissions.
Diagnose data-plane authorization and resource/firewall rules rather than replacing identity with an account key.

Explanation

Correct Answer

Give unrelated high-risk workloads separately governed managed identities and scoped permissions, and audit the effective grants for each.

Incorrect Answers

Restoring assignments to the same shared principal perpetuates the excessive cross-service privilege rather than isolating it.

Reusing a single user-assigned identity is precisely the shared principal risk described; it cannot separate audit and compromise boundaries.

A 403 diagnosis is orthogonal; a successfully shared identity can still have an unacceptable combined permission footprint.

Question 52

A production vault is created without a deletion-recovery strategy. Which change most directly addresses the described security requirement?

Use the configured recovery process and verify recovery rather than recreating the same secrets manually.
Configure supported soft-delete and purge-protection controls before storing critical material.
Prefer identity-based workload authentication and use the vault for remaining necessary secrets.
Separate security boundaries and ownership where isolation is needed.

Explanation

Correct Answer

Enable the supported Key Vault soft-delete and purge-protection safeguards before critical production data is stored, and validate the documented recovery procedures.

Incorrect Answers

Following an existing recovery procedure after deletion is insufficient if purge protection was never enabled for production critical material.

Managed identity avoids embedding secrets in workloads but cannot compensate for irreversible vault deletion or purge.

Ownership separation is good governance, but does not restore a deleted vault or prevent accidental purge of its critical secrets.

Question 53

A team places nonproduction and highly sensitive production secrets in one shared vault. Which action should be selected for this deployment?

Separate resource deployment health from data-plane access verification.
Separate security boundaries and ownership where isolation is needed.
Prefer identity-based workload authentication and use the vault for remaining necessary secrets.
Confirm Key Vault location and dependent data-processing requirements before deployment.

Explanation

Correct Answer

Use separate vaults and RBAC/security ownership for production versus nonproduction so test staff cannot inadvertently read production secrets.

Incorrect Answers

Checking deployment health versus secret-read rights is diagnostic and does not prevent nonproduction principals receiving production vault access.

Managed identities eliminate some stored credentials but do not segregate sensitive material already co-hosted across environments.

Regional placement addresses residency and latency, but does not separate developer/test and production trust boundaries inside one vault.

Question 54

A service needs keys and secrets in a selected Azure region for compliance. Which remediation is the most relevant for this failure?

Separate security boundaries and ownership where isolation is needed.
Separate resource deployment health from data-plane access verification.
Use the configured recovery process and verify recovery rather than recreating the same secrets manually.
Confirm Key Vault location and dependent data-processing requirements before deployment.

Explanation

Correct Answer

Select a Key Vault region consistent with data-residency obligations and verify dependent encryption, backup and service-data processing requirements before deployment.

Incorrect Answers

Separating team ownership can reduce blast radius but does not establish geographic residency of managed keys and secrets.

Proving data-plane reads work says nothing about whether the chosen Azure region satisfies residency constraints.

Recovering a previously deleted vault is unrelated to demonstrating that new key/secret material resides in the jurisdiction required by policy.

Question 55

An operator deletes a critical vault and assumes access can never be restored. What should the security engineer do first to resolve this case?

Separate resource deployment health from data-plane access verification.
Separate security boundaries and ownership where isolation is needed.
Prefer identity-based workload authentication and use the vault for remaining necessary secrets.
Use the configured recovery process and verify recovery rather than recreating the same secrets manually.

Explanation

Correct Answer

Locate the soft-deleted vault and use its documented recovery operation and permissions, then validate restored objects and app access.

Incorrect Answers

Checking data-plane access will not recover a deleted Key Vault resource whose name remains in the soft-delete retention state.

Creating separate environments may reduce future blast radius but cannot restore the original vault and its key/secret versions.

Switching workloads to managed identity is helpful later but does not restore deleted cryptographic objects held by the vault.

Question 56

The Key Vault resource shows healthy in Azure Resource Manager, but an application cannot get a stored secret value. Which verification differentiates resource deployment status from the failed secret data-plane request?

Separate resource deployment health from data-plane access verification.
Prefer identity-based workload authentication and use the vault for remaining necessary secrets.
Configure supported soft-delete and purge-protection controls before storing critical material.
Confirm Key Vault location and dependent data-processing requirements before deployment.

Explanation

Correct Answer

Portal/resource availability is a control-plane signal. Verify the application principal, secret data permissions and effective network route separately.

Incorrect Answers

Managed identity may provide authentication, but an identity without secret-read permission or a permitted network route still cannot retrieve the value.

Soft delete and purge protection defend against deletion, not a currently reachable vault that refuses authorized secret retrieval.

The vault region must meet policy, but regional placement does not itself confer permission to get a secret value.

Question 57

A team treats Key Vault as a permanent repository for credentials that should be phased out. What is the best next security action?

Separate security boundaries and ownership where isolation is needed.
Use the configured recovery process and verify recovery rather than recreating the same secrets manually.
Confirm Key Vault location and dependent data-processing requirements before deployment.
Prefer identity-based workload authentication and use the vault for remaining necessary secrets.

Explanation

Correct Answer

Move supported workloads to managed identities or federated identities; retain Key Vault only for secrets still necessary, with rotation and scoped access.

Incorrect Answers

Separating vaults limits cross-environment exposure but still perpetuates credentials that could instead be eliminated.

Recovering deleted objects does not reduce the long-term inventory of embedded credentials unnecessarily retained in the vault.

Region verification is a residency concern, not a strategy for replacing avoidable passwords with workload identity.

Question 58

A resource-group Contributor can manage a Key Vault but cannot read its secrets. Select TWO data-plane access steps that would let the intended application retrieve only the secrets it is entitled to read.

Identify the data-plane Key Vault permission needed by the application.
Grant vault-wide Secrets Officer to the resource-group Contributor without identifying whether the application only needs read access.
Assign the narrow data-plane role at the correct vault scope to the actual identity.
Migrate and verify role assignments for each data-plane principal before enabling the access-model change.
Apply a broad vault data role to every Contributor at the resource-group scope to avoid tracking application principals.

Explanation

Correct Answer

First identify the needed data-plane operation (read secret values). Azure management Contributor does not confer Key Vault secret-read authorization.

Give the actual application managed identity only the needed data-plane role, such as Key Vault Secrets User for secret reads, at a sufficiently narrow scope.

Incorrect Answers

Key Vault Secrets Officer permits managing secrets and is broader than the read-only operation in the scenario; granting it to a human Contributor is the wrong principal.

Migrating access-model role assignments matters only when the vault authorization model is being changed; nothing states such a migration is occurring.

Broadly granting every Contributor secret access defeats principal-specific least privilege and confuses Azure management access with vault data authorization.

Question 59

An application only performs GET on a Key Vault secret, yet its principal has Secrets Officer at vault scope. Which least-privilege replacement removes unnecessary secret-management rights?

Consolidate role assignments at appropriate vault boundaries while keeping privileged exceptions rare.
Keep the existing Key Vault Secrets Officer role because the application can already retrieve the requested value.
Distinguish certificate read permission from certificate-management roles.
Replace management privilege with a narrower secret-read role at appropriate scope.

Explanation

Correct Answer

Key Vault Secrets User supports reading secret contents without the management powers of Secrets Officer; scope it to the required vault.

Incorrect Answers

Consolidating assignment locations can improve maintainability but does not narrow an overly powerful Secrets Officer role.

Keeping a vault-management-level role when the app only needs get-secret exposes unnecessary create/update/delete secret operations.

Certificate permissions do not address an application whose requirement is only reading an existing secret value.

Question 60

An administrator enables Azure RBAC authorization but old access-policy-dependent clients fail. Which response correctly handles this condition?

Migrate and verify role assignments for each data-plane principal before enabling the access-model change.
Scope Key Vault roles to need-to-know identities rather than inheriting broad administrator groups.
Consolidate role assignments at appropriate vault boundaries while keeping privileged exceptions rare.
Assign the appropriate Key Vault data-plane role instead of assuming control-plane Contributor confers secret-read access.

Explanation

Correct Answer

Map each old access-policy principal/action to appropriate Key Vault data roles and validate actual reads before switching the vault to RBAC mode.

Incorrect Answers

General least-privilege scoping is insufficient if specific applications lose their secret/key/certificate data roles during migration.

Consolidating vault role assignments does not guarantee each access-policy-dependent principal receives matching new data-plane rights.

Contributor/Key Vault Contributor access can manage resources but does not automatically read secrets under RBAC authorization.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 4 - 10 Questions (Last Reviewed 10-Nov-2026)
Microsoft SC-500 Practice Test 5 - 10 Questions (Last Reviewed 09-Nov-2026)
Microsoft SC-500 Practice Test 6 - 10 Questions (Last Reviewed 08-Nov-2026)
Microsoft SC-500 Practice Test 7 - 10 Questions (Last Reviewed 07-Nov-2026)
Microsoft SC-500 Practice Test 8 - 10 Questions (Last Reviewed 06-Nov-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 50

Explanation

Correct Answer

Incorrect Answers

Question 51

Explanation

Correct Answer

Incorrect Answers

Question 52

Explanation

Correct Answer

Incorrect Answers

Question 53

Explanation

Correct Answer

Incorrect Answers

Question 54

Explanation

Correct Answer

Incorrect Answers

Question 55

Explanation

Correct Answer

Incorrect Answers

Question 56

Explanation

Correct Answer

Incorrect Answers

Question 57

Explanation

Correct Answer

Incorrect Answers

Question 58

Explanation

Correct Answer

Incorrect Answers

Question 59

Explanation

Correct Answer

Incorrect Answers

Question 60

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests