Microsoft SC-500 Practice Test 9

Question 80

A vulnerability report refers to secrets stored in a repository rather than the active vault. Which response correctly handles this condition?

Investigate relevant Defender for Key Vault alerts and principal activity, then contain compromised access.
Identify the true repository exposure path, rotate the values and remediate the repository.
Combine posture scanning with appropriate Defender for Key Vault protection and incident response.
Route findings to accountable teams with deadlines and verify mitigation.

Explanation

Correct Answer

Trace which repository/version exposes the credential, revoke and rotate it, and remove the value from relevant source and deployment history.

Incorrect Answers

Key Vault threat-alert triage targets runtime vault access, whereas the observed exposure is embedded in repository content.

Enabling a protection plan without removing the copied credential does not close the confirmed repository leak.

Assigning ticket owners alone leaves a potentially usable copied credential in the repository.

Question 81

A team wants to detect both exposed vault access and code-stored secrets. Which implementation decision is most appropriate here?

Identify the true repository exposure path, rotate the values and remediate the repository.
Review role grants, firewall and actual audit events independently.
Combine posture scanning with appropriate Defender for Key Vault protection and incident response.
Revoke/rotate the exposed credential and remove it from code and history instead of merely dismissing the recommendation.

Explanation

Correct Answer

Combine the supported Defender CSPM/repository secret exposure assessments with Defender for Key Vault threat detections and response procedures; these cover different code and vault-access risks.

Incorrect Answers

Repository cleanup addresses a known leak, but does not detect anomalous authenticated retrieval from the running vault.

Reviewing vault permissions/logs can identify access weaknesses but does not scan code/deployment artifacts for embedded credentials.

Rotating one detected leak is incident remediation, not the ongoing two-surface detection coverage requested by the team.

Question 82

A subscription must prevent new public storage accounts. Which change most directly addresses the described security requirement?

Assign an appropriately scoped deny policy that rejects noncompliant new or updated resources.
Evaluate a deployIfNotExists-style policy with required managed identity/remediation permissions.
Check supported policy aliases and test the definition against representative resources.
Verify management-group assignment and exemptions rather than assuming a child can override a parent.

Explanation

Correct Answer

Apply an Azure Policy deny rule at subscription or higher appropriate scope to stop new or updated storage accounts violating the public-access restriction.

Incorrect Answers

DeployIfNotExists is intended to deploy related resources or settings, not reject creation of a noncompliant public storage account at request time.

Testing aliases validates policy evaluation, yet an audit-only definition with correct aliases would still permit the forbidden deployment.

Inherited assignment and exemption review matters to scope, but without the actual Deny rule it does not block prohibited storage deployment.

Question 83

An auditor wants to find existing VMs missing approved security tags without stopping deployments. Which action should be selected for this deployment?

Assign an appropriately scoped deny policy that rejects noncompliant new or updated resources.
Use an audit effect and examine policy compliance results.
Check supported policy aliases and test the definition against representative resources.
Evaluate a deployIfNotExists-style policy with required managed identity/remediation permissions.

Explanation

Correct Answer

Assign a tag-checking Azure Policy with Audit effect, then inspect the compliance results for existing VMs without preventing creation.

Incorrect Answers

A Deny effect could block new changes and does not meet the requirement to report missing tags without stopping deployments.

Policy alias validation checks the definition but does not provide the continuing compliant/noncompliant inventory the auditor requested.

DeployIfNotExists would try to deploy related settings and is not the passive reporting-only inspection required for missing VM tags.

Question 84

A governance team wants to add diagnostic settings automatically to eligible new resources. Which remediation is the most relevant for this failure?

Verify management-group assignment and exemptions rather than assuming a child can override a parent.
Use an audit effect and examine policy compliance results.
Check supported policy aliases and test the definition against representative resources.
Evaluate a deployIfNotExists-style policy with required managed identity/remediation permissions.

Explanation

Correct Answer

DeployIfNotExists checks for related diagnostic settings and can deploy them using the policy assignment identity with appropriate permissions and remediation tasks.

Incorrect Answers

Scope/exemption review matters for applicability, not the mechanism that creates diagnostic settings after the resource is deployed.

Audit records missing diagnostics but does not automatically create their required diagnostic-settings resource.

Correct aliases alone specify what to inspect; they do not cause configuration deployment when the settings are absent.

Question 85

A child subscription inherits organization policy that conflicts with a local team preference. What should the security engineer do first to resolve this case?

Use an audit effect and examine policy compliance results.
Verify management-group assignment and exemptions rather than assuming a child can override a parent.
Assign an appropriately scoped deny policy that rejects noncompliant new or updated resources.
Evaluate a deployIfNotExists-style policy with required managed identity/remediation permissions.

Explanation

Correct Answer

Inspect inherited management-group Azure Policy assignment, exclusions and properly approved exemptions; child scope cannot silently override an enforced parent deny.

Incorrect Answers

Audit-only reporting cannot negate an enforced inherited parent policy for this resource.

Adding another deny policy at child scope cannot make an inherited parent restriction less stringent.

DeployIfNotExists is unrelated to interpreting an inherited rule that conflicts with a subscription team’s local request.

Question 86

A custom policy does not detect resource property values because its alias is wrong. Which control would most directly close the security gap?

Use an audit effect and examine policy compliance results.
Change the Azure Policy display name and rerun compliance without correcting the unsupported resource-property alias.
Check supported policy aliases and test the definition against representative resources.
Verify management-group assignment and exemptions rather than assuming a child can override a parent.

Explanation

Correct Answer

Use supported Azure Policy field aliases for the resource type/API version; test evaluation on representative resource payloads and fix the definition.

Incorrect Answers

Changing the effect to Audit will still evaluate the wrong alias and can give false compliance results.

Renaming the assignment or definition has no effect on which resource-property alias the policy engine evaluates.

Parent-scope inheritance does not explain why an individual custom definition reads an unsupported property alias.

Question 87

A compliance manager mistakes 95% Defender score for a formal legal certification. What is the best next security action?

Export or retain control-specific resource evidence instead of citing only a dashboard summary.
Select correct standard assignments and interpret each recommendation's mapping separately.
Interpret assessment status and supporting evidence without asserting automatic regulator approval.
Confirm Defender onboarding, permissions, plan coverage and assessment ingestion.

Explanation

Correct Answer

Defender assessment percentages summarize assessed technical controls; formal compliance requires evidence, scope and independently applicable audit decisions.

Incorrect Answers

Exporting detailed evidence is useful to auditors but does not alone authorize an assertion of legal or regulator-issued certification.

Assigning additional standards changes the controls being measured, not whether regulators have formally certified the organization.

Onboarding completeness affects assessment coverage but cannot convert a numerical security score into third-party regulatory certification.

Question 88

An Azure resource is listed as unhealthy under a mandated security control. Which control best addresses the actual risk described?

Inspect the exact recommendation and remediate the affected resource configuration.
Review resource applicability and exemption rationale before marking it complete.
Select correct standard assignments and interpret each recommendation's mapping separately.
Export or retain control-specific resource evidence instead of citing only a dashboard summary.

Explanation

Correct Answer

Inspect the exact failed Defender recommendation/resource and correct the indicated configuration; a dashboard label alone does not show what needs fixing.

Incorrect Answers

Exemptions apply only with an approved rationale; they must not be used merely to hide a relevant and remediable weakness.

Switching regulatory standard assignments cannot remediate the resource’s actual failed security configuration.

Exporting evidence records the unhealthy state but does not make the affected resource meet the control.

Question 89

A control appears not applicable to a resource group. Which configuration or verification action best fits the scenario?

Inspect the exact recommendation and remediate the affected resource configuration.
Export or retain control-specific resource evidence instead of citing only a dashboard summary.
Review resource applicability and exemption rationale before marking it complete.
Confirm Defender onboarding, permissions, plan coverage and assessment ingestion.

Explanation

Correct Answer

Verify whether the assessment actually applies to this resource type and scope, and document any justified exemption without treating unknown as compliant.

Incorrect Answers

Changing resource configuration before confirming applicability could waste effort on a control unrelated to this resource type.

Evidence export is for assessment documentation; it cannot establish that a control is relevant to the resource group.

An absent finding can reflect plan coverage, but that alone does not establish why the particular control is inapplicable.

Question 90

A multi-subscription audit is missing results from one subscription. Which response correctly handles this condition?

Review resource applicability and exemption rationale before marking it complete.
Export or retain control-specific resource evidence instead of citing only a dashboard summary.
Confirm Defender onboarding, permissions, plan coverage and assessment ingestion.
Interpret assessment status and supporting evidence without asserting automatic regulator approval.

Explanation

Correct Answer

Verify Defender for Cloud coverage, plan and regulatory standard assignments, role visibility and whether resources have been assessed/ingested in that subscription.

Incorrect Answers

Marking resources not applicable without checking missing onboarding can conceal an actual coverage gap.

Exporting existing assessment evidence cannot recover findings that were never evaluated or visible for that subscription.

A high dashboard score elsewhere does not explain why the particular subscription has no reported assessments.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 7 - 10 Questions (Last Reviewed 07-Nov-2026)
Microsoft SC-500 Practice Test 8 - 10 Questions (Last Reviewed 06-Nov-2026)
Microsoft SC-500 Practice Test 9 - 10 Questions (Last Reviewed 05-Nov-2026)
Microsoft SC-500 Practice Test 10 - 10 Questions (Last Reviewed 04-Nov-2026)
Microsoft SC-500 Practice Test 11 - 10 Questions (Last Reviewed 03-Nov-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 80

Explanation

Correct Answer

Incorrect Answers

Question 81

Explanation

Correct Answer

Incorrect Answers

Question 82

Explanation

Correct Answer

Incorrect Answers

Question 83

Explanation

Correct Answer

Incorrect Answers

Question 84

Explanation

Correct Answer

Incorrect Answers

Question 85

Explanation

Correct Answer

Incorrect Answers

Question 86

Explanation

Correct Answer

Incorrect Answers

Question 87

Explanation

Correct Answer

Incorrect Answers

Question 88

Explanation

Correct Answer

Incorrect Answers

Question 89

Explanation

Correct Answer

Incorrect Answers

Question 90

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests