Free Practice Questions for Microsoft SC-500 Exam

Statement

Answer

Connections from VM1 to storage1 always use IP address 10.1.1.5.

Yes

Connections from VM2 to Vault1 always use IP address 20.224.219.230.

No

Authentication from VM3 to the tenant uses either IP address 10.11.1.5 or 40.122.155.212.

No

Comprehensive and Detailed 150 to 250 words of Explanation From [Cloud and AI Security Engineer/Course Guide/topics]:

VM1 → storage1 = Yes. VNET1/Subnet1 has the Microsoft.Storage service endpoint enabled. Microsoft states that when a service endpoint is enabled, traffic to that Azure service changes from using the VM’s public IPv4 address to using its private virtual-network IP address as the source. Therefore, storage1 sees VM1 as 10.1.1.5.

VM2 → Vault1 = No. VNET1/Subnet2 has the Microsoft.KeyVault service endpoint. Consequently, traffic from VM2 to Key Vault uses VM2’s private address, 10.1.2.5, rather than its public address 20.224.219.230. Microsoft explicitly documents this source-IP transition for service-endpoint traffic.

VM3 → Microsoft Entra tenant = No. VM3’s subnet has service endpoints for Storage and Key Vault, but not for Microsoft Entra ID. Therefore, authentication traffic to Microsoft Entra is not routed through either of those service endpoints. It uses VM3’s normal public outbound path, represented here by 40.122.155.212, rather than potentially using either the private or public address. The “either” statement is therefore false.

Statement

Answer

User2 can sign in to Microsoft 365 services from their home network.

Yes

User3 can sign in to the Azure portal from a public Wi-Fi network by using a compliant device.

No

User1 will be prompted for multifactor authentication (MFA) when they sign in to Microsoft 365 services from the HQ-Trusted network.

No

User2 = Yes. User2 belongs to Group2, so User2 is explicitly excluded from CA2. CA1 does apply because User2 is not in Group1 and Microsoft 365 is targeted. CA1 is not a block policy; it grants access after both MFA and device compliance requirements are satisfied. Microsoft confirms that when Require all selected controls is configured, every selected grant control must be met. Microsoft Learn

User3 = No. User3 is excluded from neither policy. For an Azure portal sign-in, CA1 does not apply because CA1 targets Office 365. CA2 does apply because it targets all resources, User3 is not in Group2, and public Wi-Fi is outside HQ-Trusted. CA2 therefore blocks access outright, regardless of the device being compliant. Microsoft Learn

User1 = No. User1 is in Group1 and therefore excluded from CA1, so CA1 ' s MFA requirement does not apply. CA2 would normally include User1, but the sign-in occurs from HQ-Trusted, which CA2 explicitly excludes. Microsoft documents that an Any location policy can exclude specific trusted locations.

The requirement is centralized enforcement for all databases on the logical server. Microsoft Entra-only authentication disables SQL authentication at the server level, so SQL logins cannot be used against any database hosted there. Configuring an Entra administrator is typically a prerequisite or supporting step, but by itself it does not disable SQL authentication. A managed identity for the server and deleting logins from one database do not meet the central enforcement requirement. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure SQL authentication; Microsoft Learn > Microsoft Entra-only authentication for Azure SQL.

==============================================================

A private endpoint is the correct solution because it assigns a private IP address from an Azure virtual network to the Azure SQL logical server connection, allowing clients with connectivity to that virtual network to reach SQL Database without traversing the public endpoint. After the private endpoint is configured, public network access can be disabled on Server1, ensuring that database connectivity occurs exclusively through Azure Private Link. Microsoft specifically documents that App Service applications using VNet Integration can connect to Azure SQL Database through a private endpoint, provided DNS resolves the SQL server name to the private endpoint address.

A service endpoint does not satisfy the requirement because Azure SQL still exposes and uses its public service endpoint; the service endpoint only identifies and secures traffic originating from an authorized subnet. A Private Link service is used to privately expose a customer-owned service, typically behind a Standard Load Balancer, rather than to consume an existing Azure PaaS service such as Azure SQL. A routing table cannot provide Server1 with private PaaS connectivity.

The SC-500 study guide explicitly includes configuring Azure private endpoints to secure access to Azure PaaS resources under the Secure storage, databases, and networking domain.

WebApp1 → VM2: Yes. Regional App Service virtual network integration provides outbound connectivity from an App Service application into the integrated virtual network and also to resources in peered virtual networks. Because WebApp1 integrates with VNet1 and VNet1 is peered with VNet2, WebApp1 can reach VM2 in Subnet2. Microsoft explicitly lists peered virtual networks as supported destinations for VNet-integrated App Service applications. Microsoft Learn

NSG1 controls inbound traffic to WebApp1: No. For multitenant App Service, VNet integration is an outbound-only networking feature. Microsoft states that inbound NSG rules on the integration subnet do not control inbound requests to the web app. Inbound access should instead be controlled by mechanisms such as App Service access restrictions or private endpoints. Microsoft Learn

WebApp2 → VM1: Yes. An Isolated App Service plan runs in an App Service Environment, which is deployed directly into a virtual network subnet. Apps in an App Service Environment can reach resources in that virtual network and in connected networks. Because VNet2 is peered with VNet1 and the NSGs have only their default rules, WebApp2 can reach VM1 through the peering connection.

Configure Workspace2 for embedded agent traffic. The distinction in the scenario is between the standalone Security Copilot experience used by SOC analysts and the embedded experience used by security administrators inside Microsoft Defender. Microsoft defines access through the Security Copilot portal as the standalone experience, while Security Copilot functionality accessed from Microsoft Defender and other integrated Microsoft security products is classified as an embedded experience.

Workspace2 already has its own capacity of five Security Compute Units, so the missing configuration is to route the embedded workload to that workspace. Configuring Workspace2 for embedded agent traffic causes usage originating from the administrators ' embedded Defender experience to consume Workspace2 ' s associated capacity, while SOC analysts can continue using Workspace1 for their standalone sessions.

Increasing Workspace2 capacity changes the number of available SCUs but does not determine which workload consumes them. Assigning Workspace1 ' s capacity to Workspace2 is also inappropriate because Security Copilot capacities are associated with workspaces and SCUs cannot be shared between workspaces. Configuring Workspace1 for embedded traffic would route the administrators ' embedded usage to the wrong workspace.

Microsoft ' s SC-500 objectives explicitly include configuring Security Copilot workspaces and managing Security Copilot under Manage and monitor security posture.

Assign Virtual Machine User Login to User1. Microsoft Entra authentication for supported Azure Arc-enabled Windows servers uses Azure RBAC to authorize RDP sign-in. Microsoft specifies two relevant roles: Virtual Machine Administrator Login, which provides administrator privileges, and Virtual Machine User Login, which provides standard user privileges. Because the requirement is only for User1 to sign in and explicitly requires least privilege, Virtual Machine User Login is the correct role.

Assigning Virtual Machine Administrator Login would also permit access, but it unnecessarily grants local administrative privileges and therefore violates least privilege. Adding User1 manually to the local Remote Desktop Users group is not the correct authorization model for Microsoft Entra-based Arc sign-in. Microsoft specifically requires the appropriate Azure login role and documents that manual local-group elevation is not the supported mechanism for authorizing Microsoft Entra sign-in.

A Conditional Access policy requiring MFA can impose an additional authentication condition, but it does not provide the underlying authorization required to log on to SRV1.

The SC-500 study guide places extending security controls to hybrid servers by using Azure Arc within the Secure compute domain.

===============

Configure an inbound access restriction on App1 that explicitly allows the partner ' s public IP address. Azure Functions running on App Service infrastructure support access restriction rules that operate as an inbound network ACL. Microsoft states that these rules can contain individual IPv4/IPv6 addresses or ranges and that once one or more rules are configured, unmatched traffic can be denied. This directly supports the requirement to accept HTTP requests only from the specified partner IP.

The existing virtual network integration does not control inbound access. Microsoft specifically defines VNet integration as an outbound networking capability. Consequently, an NSG associated with the integration subnet affects traffic originating from the Function App but does not filter requests arriving at the Function App ' s public endpoint.

A private endpoint would eliminate normal public access and therefore would not support a partner that connects from a public Internet IP unless additional private connectivity were implemented. Azure Bastion is for administrative connectivity to VMs, while NAT Gateway controls outbound source addressing.

The SC-500 study guide explicitly includes configuring Azure Functions authentication and network access under Secure compute.

===============