Microsoft SC-500 Practice Test 7

Question 60

An administrator enables Azure RBAC authorization but old access-policy-dependent clients fail. Which response correctly handles this condition?

Migrate and verify role assignments for each data-plane principal before enabling the access-model change.
Scope Key Vault roles to need-to-know identities rather than inheriting broad administrator groups.
Consolidate role assignments at appropriate vault boundaries while keeping privileged exceptions rare.
Assign the appropriate Key Vault data-plane role instead of assuming control-plane Contributor confers secret-read access.

Explanation

Correct Answer

Map each old access-policy principal/action to appropriate Key Vault data roles and validate actual reads before switching the vault to RBAC mode.

Incorrect Answers

General least-privilege scoping is insufficient if specific applications lose their secret/key/certificate data roles during migration.

Consolidating vault role assignments does not guarantee each access-policy-dependent principal receives matching new data-plane rights.

Contributor/Key Vault Contributor access can manage resources but does not automatically read secrets under RBAC authorization.

Question 61

A sensitive vault has many per-secret individual role grants that are hard to audit. Which implementation decision is most appropriate here?

Scope Key Vault roles to need-to-know identities rather than inheriting broad administrator groups.
Replace management privilege with a narrower secret-read role at appropriate scope.
Assign the appropriate Key Vault data-plane role instead of assuming control-plane Contributor confers secret-read access.
Consolidate role assignments at appropriate vault boundaries while keeping privileged exceptions rare.

Explanation

Correct Answer

For routine applications prefer vault-scoped role assignments and vault-per-application/environment boundaries over hundreds of hard-to-audit individual-object grants.

Incorrect Answers

Limiting principals is necessary least privilege, but independent secret-scoped grants remain difficult to maintain and audit.

Secrets User is narrower than Secrets Officer but role choice alone does not remove sprawl of per-object authorization entries.

Giving a management-plane Contributor role does not consolidate or correctly replace the existing object-specific data-plane permissions.

Question 62

A tool is intentionally granted read-only access to inspect Key Vault certificates. Its operator asks why it cannot issue or renew certificates. Which permission distinction explains the limitation without giving the inspection tool unnecessary issuance rights?

Assign the appropriate Key Vault data-plane role instead of assuming control-plane Contributor confers secret-read access.
Replace management privilege with a narrower secret-read role at appropriate scope.
Distinguish certificate read permission from certificate-management roles.
Scope Key Vault roles to need-to-know identities rather than inheriting broad administrator groups.

Explanation

Correct Answer

Key Vault Certificate User can read contents, whereas a certificate management role is required for authorized issuance/import/renewal operations; never grant issuance to inspection-only workloads.

Incorrect Answers

Control-plane Contributor does not grant certificate data-plane issuance; the right Key Vault certificate role model governs this operation.

Secret-read permission concerns secret values and cannot authorize Key Vault certificate lifecycle operations or explain a certificate-read-only role.

Narrowing role scope is appropriate but cannot turn a read-only certificate role into certificate issuance permission.

Question 63

A team assigns a privileged Key Vault role to all subscription contributors. Which action should be selected for this deployment?

Scope Key Vault roles to need-to-know identities rather than inheriting broad administrator groups.
Distinguish certificate read permission from certificate-management roles.
Migrate and verify role assignments for each data-plane principal before enabling the access-model change.
Consolidate role assignments at appropriate vault boundaries while keeping privileged exceptions rare.

Explanation

Correct Answer

Grant Key Vault data roles only to individually authorized or narrowly governed groups at the smallest practical vault boundary; remove broad contributor membership.

Incorrect Answers

Certificate-reader versus certificate-officer distinctions do not justify adding every subscription Contributor to a privileged Key Vault role.

Changing access models might be needed during migration, but cannot remove current overbroad principal assignments by itself.

Consolidating at a vault scope would be dangerous if the assigned principal remains the entire broad subscription-contributor group.

Question 64

A build agent has Key Vault Secrets User but receives a network access denial. Which remediation is the most relevant for this failure?

Assume a Key Vault Secrets User role automatically bypasses the vault firewall for any Azure-hosted build agent.
Check vault firewall/private endpoint network routing before adding more RBAC roles.
Prefer explicit approved network paths and validate the caller's source.
Correct private DNS integration and verify resolution from the calling network.

Explanation

Correct Answer

Inspect the agent egress IP, effective vault public-network rules and permitted private endpoint route; adding RBAC roles does not clear a network-layer deny.

Incorrect Answers

A Key Vault data role cannot bypass an IP firewall or private endpoint; do not treat Secrets User as network permission.

A generic trusted-services exception is not proof this build agent has a permitted source path and should not be enabled indiscriminately.

DNS matters when the caller resolves the wrong endpoint, but the stated denial requires examining effective vault firewall/private-path connectivity before assuming resolution is the cause.

Question 65

A Key Vault must be reachable by clients only through an approved private VNet path, with public ingress disabled. Select THREE network-and-name-resolution settings that establish that private-only route.

Prefer explicit approved network paths and validate the caller's source.
Restrict unnecessary public network access to the vault.
Verify only the calling principal’s Key Vault secret-read permission and assume that this also forces network traffic through the private endpoint.
Update the public DNS record to the vault public IP and leave the private DNS zone unlinked to the consuming network.
Create an approved Key Vault private endpoint for the intended virtual network.
Confirm clients resolve and reach the private vault endpoint through approved DNS and routing.

Explanation

Correct Answer

Disabling public network access closes unintended internet-side data-plane routes so authorized callers must use an approved private connectivity path.

A private endpoint maps this Key Vault service into an approved private network interface, providing a nonpublic connectivity target.

Link the appropriate privatelink.vaultcore.azure.net private DNS integration to consuming networks and test private name resolution and routing from actual clients.

Incorrect Answers

A general preference for approved paths is not itself a configured private endpoint, DNS association, or block on public ingress.

An identity’s secret-read permission affects data authorization, not whether traffic resolves to a public or private Key Vault endpoint.

Resolving the vault to its public IP and omitting private-zone links defeats private endpoint name resolution for VNet clients.

Question 66

A private endpoint exists but clients resolve a public vault address. Which control would most directly close the security gap?

Check vault firewall/private endpoint network routing before adding more RBAC roles.
Configure Key Vault private endpoint and appropriate public-network restrictions.
Verify both network exception eligibility and the principal's data-plane authorization.
Correct private DNS integration and verify resolution from the calling network.

Explanation

Correct Answer

Associate the correct private DNS zone with the calling VNet/forwarding path, resolve the vault FQDN from the workload and verify it targets the private endpoint IP.

Incorrect Answers

Firewall checks are useful but a private endpoint by itself does not make the public vault hostname resolve privately to clients.

Adding another private endpoint or public access restriction is not the specific correction when the approved private endpoint already exists and DNS remains public.

Network exception and data-plane RBAC checks do not correct a hostname still pointing the workload to the vault’s public path.

Question 67

A developer proposes enabling public access for every IP to fix a single pipeline failure. What is the best next security action?

Check vault firewall/private endpoint network routing before adding more RBAC roles.
Correct private DNS integration and verify resolution from the calling network.
Allow the entire Azure service address range to reach the vault without confirming this pipeline is a supported trusted service or using its actual source path.
Prefer explicit approved network paths and validate the caller's source.

Explanation

Correct Answer

Authorize only the pipeline’s verified egress address, private endpoint or supported exception and prove the caller uses that path; never permit every public IP.

Incorrect Answers

Inspecting the failed route is helpful, but it does not authorize exposing the vault to all internet sources as the developer proposed.

Changing private DNS without evidence of a private resolution failure may not help, and it does not justify a wildcard network exception.

Opening a subscription-wide public firewall rule would enlarge the allowed attack surface even though only this pipeline requires access.

Question 68

A Key Vault is configured to allow trusted Microsoft services, but an Azure-hosted workload still gets HTTP 403 reading a secret. Which answer checks BOTH whether its service/path qualifies for the network exception and whether its real principal has secret data permission?

Prefer explicit approved network paths and validate the caller's source.
Assume the trusted-services setting automatically gives any Azure-hosted workload both firewall access and secret-read authorization.
Verify both network exception eligibility and the principal's data-plane authorization.
Correct private DNS integration and verify resolution from the calling network.

Explanation

Correct Answer

Confirm the caller is an eligible trusted service under the exception AND that its actual service principal has the necessary secret/key role or access-policy operation.

Incorrect Answers

A private DNS change does not fix missing secret-read permission when the Azure service already reaches the vault’s permitted endpoint.

A firewall trusted-services flag does not grant any Azure service an automatic Key Vault secret data-plane entitlement.

Expanding public network ranges would weaken the vault and does not grant the service principal permission to read the object.

Question 69

A backend caches an expired API token read from a vault. Which configuration or verification action best fits the scenario?

Stage version/binding transition and verify availability before retiring old material.
Revoke the value, rotate dependents and confirm inactive versions are not accepted.
Use controlled secret rotation with overlap and refresh consuming services before old version retirement.
Rotate/renew the certificate and verify consuming application binding and chain.

Explanation

Correct Answer

Issue/rotate the required API token, allow overlap if supported, and refresh the backend’s cached version before withdrawing the old one.

Incorrect Answers

Refreshing a TLS certificate binding cannot replace the expired API token read from a Key Vault secret.

Revoking an exposed credential is urgent after compromise, but the scenario is scheduled expiry, so stage consumer refresh to avoid outage.

Renewing a TLS certificate changes web-server identity material, not the expired API token cached by the backend.

Question 70

An encryption workload requires operations on a protected key without exposing raw key material. Which response correctly handles this condition?

Match certificate content/import format to the actual use and verify private-key availability under policy.
Stage version/binding transition and verify availability before retiring old material.
Grant approved cryptographic key operations rather than reading a secret or exporting private material.
Revoke the value, rotate dependents and confirm inactive versions are not accepted.

Explanation

Correct Answer

Authorize crypto operations such as encrypt, decrypt, wrapKey or unwrapKey using the proper Key Vault key role, while keeping private key material nonexportable.

Incorrect Answers

Import format and private-key handling matter to TLS certificates, not the requirement to perform encryption without exporting a protected vault key.

Staging a version transition is a lifecycle step; it does not grant the workload the approved key-usage actions it needs.

Revocation of an exposed secret does not grant cryptographic operations on the managed vault key.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 5 - 10 Questions (Last Reviewed 09-Nov-2026)
Microsoft SC-500 Practice Test 6 - 10 Questions (Last Reviewed 08-Nov-2026)
Microsoft SC-500 Practice Test 7 - 10 Questions (Last Reviewed 07-Nov-2026)
Microsoft SC-500 Practice Test 8 - 10 Questions (Last Reviewed 06-Nov-2026)
Microsoft SC-500 Practice Test 9 - 10 Questions (Last Reviewed 05-Nov-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 60

Explanation

Correct Answer

Incorrect Answers

Question 61

Explanation

Correct Answer

Incorrect Answers

Question 62

Explanation

Correct Answer

Incorrect Answers

Question 63

Explanation

Correct Answer

Incorrect Answers

Question 64

Explanation

Correct Answer

Incorrect Answers

Question 65

Explanation

Correct Answer

Incorrect Answers

Question 66

Explanation

Correct Answer

Incorrect Answers

Question 67

Explanation

Correct Answer

Incorrect Answers

Question 68

Explanation

Correct Answer

Incorrect Answers

Question 69

Explanation

Correct Answer

Incorrect Answers

Question 70

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests