Microsoft SC-500 Practice Test 8

Question 70

An encryption workload requires operations on a protected key without exposing raw key material. Which response correctly handles this condition?

Match certificate content/import format to the actual use and verify private-key availability under policy.
Stage version/binding transition and verify availability before retiring old material.
Grant approved cryptographic key operations rather than reading a secret or exporting private material.
Revoke the value, rotate dependents and confirm inactive versions are not accepted.

Explanation

Correct Answer

Authorize crypto operations such as encrypt, decrypt, wrapKey or unwrapKey using the proper Key Vault key role, while keeping private key material nonexportable.

Incorrect Answers

Import format and private-key handling matter to TLS certificates, not the requirement to perform encryption without exporting a protected vault key.

Staging a version transition is a lifecycle step; it does not grant the workload the approved key-usage actions it needs.

Revocation of an exposed secret does not grant cryptographic operations on the managed vault key.

Question 71

A TLS certificate is near expiry and its application is still serving the old bound certificate. Which action both RENEWS the credential and validates the actual replacement presented to clients?

Match certificate content/import format to the actual use and verify private-key availability under policy.
Rotate/renew the certificate and verify consuming application binding and chain.
Use controlled secret rotation with overlap and refresh consuming services before old version retirement.
Stage version/binding transition and verify availability before retiring old material.

Explanation

Correct Answer

Renew or replace the TLS certificate, update the consuming service’s binding and verify the served certificate chain and expiration date.

Incorrect Answers

Certificate import/private-key format is relevant to onboarding, not specifically completing renewal of the expiring bound certificate.

Rotating an application API secret is independent of TLS certificate renewal and cannot fix a server presenting the old certificate.

Planning a binding transition is not enough if the actual expiring TLS certificate has not been renewed and deployed to the application.

Question 72

A team stores an encryption key as ordinary app configuration instead of a vault key. Which change most directly addresses the described security requirement?

Rotate/renew the certificate and verify consuming application binding and chain.
Move cryptographic operations to an appropriately protected Key Vault key with least-privilege access.
Use controlled secret rotation with overlap and refresh consuming services before old version retirement.
Match certificate content/import format to the actual use and verify private-key availability under policy.

Explanation

Correct Answer

Place the key in a suitable Key Vault or managed HSM key object and use least-privilege key operations instead of exposing material in app settings.

Incorrect Answers

Renewing a TLS certificate protects a separate identity artifact, not the confidentiality of an application data-encryption key.

Rotating an API secret is unrelated to protecting a long-lived cryptographic key incorrectly embedded in application configuration.

Certificate import policy manages TLS certificate objects; it does not replace the application-held encryption key with vault-backed crypto.

Question 73

An incident exposes an old secret version through deployment logs. Which action should be selected for this deployment?

Revoke the value, rotate dependents and confirm inactive versions are not accepted.
Rotate/renew the certificate and verify consuming application binding and chain.
Move cryptographic operations to an appropriately protected Key Vault key with least-privilege access.
Stage version/binding transition and verify availability before retiring old material.

Explanation

Correct Answer

Treat the logged secret version as compromised: revoke its effective downstream authorization, rotate credentials and prove the old value is rejected.

Incorrect Answers

Certificate renewal does not deactivate an exposed API/secret value that was copied into deployment logs.

Moving unrelated encryption operations to vault keys does not invalidate the actual disclosed secret version.

Staging gradual retirement is unsuitable for a leaked credential if it leaves the known compromised value valid during transition.

Question 74

An operator deletes the active certificate before dependent services are updated. Which remediation is the most relevant for this failure?

Stage version/binding transition and verify availability before retiring old material.
Match certificate content/import format to the actual use and verify private-key availability under policy.
Use controlled secret rotation with overlap and refresh consuming services before old version retirement.
Grant approved cryptographic key operations rather than reading a secret or exporting private material.

Explanation

Correct Answer

Deploy the replacement certificate/version and validate each dependent service binding before retiring the previously active certificate.

Incorrect Answers

Checking import format will not restore availability if production is still bound to a certificate that the operator removed.

API-secret overlap is a useful separate pattern but does not verify which certificate each TLS endpoint is serving.

Key wrap/decrypt permissions are irrelevant to certificate binding rollover and do not prevent the outage.

Question 75

A TLS certificate import fails because the PKCS#12 package omits its required private key. Select TWO checks needed to validate the package and securely use the certificate AFTER a corrected import.

Confirm the private key is accessible only to the approved workload identity.
Verify the certificate-import format contains the key material required by the TLS binding.
Grant approved cryptographic key operations rather than reading a secret or exporting private material.
Replace the required TLS certificate/private-key pair with a Key Vault cryptographic key that has no certificate binding or usable certificate chain.
Renew the public certificate and retry import without correcting the PKCS#12 package’s missing private key.

Explanation

Correct Answer

After a valid import, restrict access to the required certificate/secret or key operations for the intended workload; broad access would expose private material.

Azure Key Vault certificate import accepts PFX or PEM material containing the matching private key; a public certificate alone cannot establish TLS server identity.

Incorrect Answers

Granting unrelated cryptographic key operations does not supply the TLS certificate and its matching private key required for a certificate-based binding.

A standalone Key Vault cryptographic key without a certificate chain and private-key binding cannot replace the required TLS certificate package.

Changing the certificate renewal date or testing an application binding before supplying a matching private key cannot repair an import package that lacks that key.

Question 76

Defender CSPM flags a leaked credential embedded in infrastructure code. Which control would most directly close the security gap?

Investigate relevant Defender for Key Vault alerts and principal activity, then contain compromised access.
Revoke/rotate the exposed credential and remove it from code and history instead of merely dismissing the recommendation.
Combine posture scanning with appropriate Defender for Key Vault protection and incident response.
Run additional repository vulnerability scans but leave the already discovered IaC credential active and embedded in Git history.

Explanation

Correct Answer

Invalidate and rotate the leaked credential, clean the source and commit history appropriately, and deploy the new value through secure secret handling.

Incorrect Answers

Defender for Key Vault runtime alerts do not revoke or remove the already exposed credential from IaC artifacts.

Layered threat detection can help later, but cannot substitute for containment of this specific disclosed credential in an infrastructure file.

Adding more vulnerability or posture scans cannot make the credential safe while the copied value remains valid and embedded in repository history.

Question 77

A vault suddenly experiences suspicious bulk secret retrieval. What is the best next security action?

Identify the true repository exposure path, rotate the values and remediate the repository.
Review role grants, firewall and actual audit events independently.
Investigate relevant Defender for Key Vault alerts and principal activity, then contain compromised access.
Combine posture scanning with appropriate Defender for Key Vault protection and incident response.

Explanation

Correct Answer

Correlate Defender for Key Vault alerts with vault audit data, principal identity, IP patterns and retrieval rate; contain potentially compromised principals promptly.

Incorrect Answers

Searching repository leaks may matter if code was exposed, but this is a suspicious runtime burst of Key Vault secret reads.

Reading static role grants is not enough to investigate which identity just retrieved many secret values and whether it is compromised.

Enabling additional posture scans does not replace immediate alert triage and containment of suspicious vault activity.

Question 78

An organization enables secret scanning but never assigns owners for findings. Which control best addresses the actual risk described?

Investigate relevant Defender for Key Vault alerts and principal activity, then contain compromised access.
Review role grants, firewall and actual audit events independently.
Route findings to accountable teams with deadlines and verify mitigation.
Combine posture scanning with appropriate Defender for Key Vault protection and incident response.

Explanation

Correct Answer

Assign the Defender secret findings to accountable service owners, track remediation and deadlines, and verify rotation/removal rather than merely acknowledging alerts.

Incorrect Answers

Investigating Key Vault anomaly alerts is for active suspicious vault behavior, not missing accountability for existing scan findings.

Access review alone does not ensure each detected code/machine secret finding is assigned, remediated and verified closed.

Adding more scanning or threat plans creates findings but does not establish the ownership and closure workflow that is missing.

Question 79

An administrator treats clean secret-scan findings as proof no vault access risk exists. Which configuration or verification action best fits the scenario?

Review role grants, firewall and actual audit events independently.
Route findings to accountable teams with deadlines and verify mitigation.
Identify the true repository exposure path, rotate the values and remediate the repository.
Combine posture scanning with appropriate Defender for Key Vault protection and incident response.

Explanation

Correct Answer

Inspect principal data-plane role assignments, vault firewall/private paths and audit activity independently; a clean secret scan is not a full access assessment.

Incorrect Answers

Assigning owners improves handling of findings but cannot prove a vault is safe simply because the scanning engine finds no plaintext secrets.

Removing repository leaks is a different remediation when a leaked source credential is actually identified; none is established here.

Adding detection plans may help, but posture-secret scanning is not a complete authorization or network-configuration audit.

Question 80

A vulnerability report refers to secrets stored in a repository rather than the active vault. Which response correctly handles this condition?

Investigate relevant Defender for Key Vault alerts and principal activity, then contain compromised access.
Identify the true repository exposure path, rotate the values and remediate the repository.
Combine posture scanning with appropriate Defender for Key Vault protection and incident response.
Route findings to accountable teams with deadlines and verify mitigation.

Explanation

Correct Answer

Trace which repository/version exposes the credential, revoke and rotate it, and remove the value from relevant source and deployment history.

Incorrect Answers

Key Vault threat-alert triage targets runtime vault access, whereas the observed exposure is embedded in repository content.

Enabling a protection plan without removing the copied credential does not close the confirmed repository leak.

Assigning ticket owners alone leaves a potentially usable copied credential in the repository.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 6 - 10 Questions (Last Reviewed 08-Nov-2026)
Microsoft SC-500 Practice Test 7 - 10 Questions (Last Reviewed 07-Nov-2026)
Microsoft SC-500 Practice Test 8 - 10 Questions (Last Reviewed 06-Nov-2026)
Microsoft SC-500 Practice Test 9 - 10 Questions (Last Reviewed 05-Nov-2026)
Microsoft SC-500 Practice Test 10 - 10 Questions (Last Reviewed 04-Nov-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 70

Explanation

Correct Answer

Incorrect Answers

Question 71

Explanation

Correct Answer

Incorrect Answers

Question 72

Explanation

Correct Answer

Incorrect Answers

Question 73

Explanation

Correct Answer

Incorrect Answers

Question 74

Explanation

Correct Answer

Incorrect Answers

Question 75

Explanation

Correct Answer

Incorrect Answers

Question 76

Explanation

Correct Answer

Incorrect Answers

Question 77

Explanation

Correct Answer

Incorrect Answers

Question 78

Explanation

Correct Answer

Incorrect Answers

Question 79

Explanation

Correct Answer

Incorrect Answers

Question 80

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests