Free Microsoft SC-500 practice questions

10 free Microsoft SC-500 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 121 questions. Work through them, then open each answer to check your reasoning.

Get all 121 questions (US$39) · Download these 10 as a PDF

Question 1

You have an Azure SQL Database logical server named Server1 that contains a database named DB1.

You need to configure authentication for Server1 to meet the following requirements:

SQL authentication cannot be used for any databases on Server1.

The solution must be enforced centrally at the server level.

What should you do?

  1. Configure a Microsoft Entra administrator for Server1.
  2. Enable a managed identity for Server1.
  3. Enable Microsoft Entra-only authentication for Server1.
  4. Remove SQL logins from DB1.
Show answer and explanation

Correct answer: C. Enable Microsoft Entra-only authentication for Server1.

Server1. Microsoft Entra-only authentication is a server-level setting on the Azure SQL logical server. Once enabled, the server refuses every SQL authentication connection across all of its databases, while existing SQL logins stay in place. That is exactly what the requirements ask for: SQL authentication unusable for any database on Server1, enforced centrally in one place rather than database by database.

Why the other options are wrong

  • A. Adding a Microsoft Entra administrator enables Entra authentication alongside SQL authentication. It permits the new method but never disables the old one.
  • B. A managed identity gives Server1 an identity for reaching out to other Azure resources. It has no bearing on how clients authenticate inbound to the server.
  • D. Removing SQL logins from DB1 is a per-database action that leaves other databases untouched and does not stop new SQL logins being created later. It fails the central enforcement requirement.

Question 2

You have a Microsoft Entra tenant that has the following configurations:

User consent for applications is disabled.

Only administrators can grant permissions to applications.

You register an application named App1 that uses delegated Microsoft Graph permissions.

You need to configure App1 to meet the following requirements:

Enable user sign-ins without interactive consent prompts.

Enable App1 to access Microsoft Graph on behalf of the signed-in user.

What should you do?

  1. Configure enterprise applications to require user assignment and assign users to App1.
  2. Modify the app registration to use application permissions instead of delegated permissions.
  3. Add the required delegated Microsoft Graph permissions to the app registration and rely on user consent during sign-in.
  4. Grant admin consent to App1 for the required delegated permissions.
Show answer and explanation

Correct answer: D. Grant admin consent to App1 for the required delegated permissions.

User consent is disabled tenant-wide, so a user can never approve the delegated permissions themselves and would be blocked at sign-in. Granting tenant-wide admin consent pre-approves the delegated Microsoft Graph permissions on behalf of the whole organization. Users then sign in with no interactive consent prompt, and because the permissions remain delegated, App1 still calls Graph as the signed-in user.

Why the other options are wrong

  • A. Requiring user assignment controls which users are allowed to access App1. It governs access, not consent, so the consent prompt still blocks sign-in.
  • B. Application permissions run as the app itself with no signed-in user, which breaks the requirement that App1 act on behalf of the user.
  • C. Relying on user consent during sign-in is precisely what the tenant configuration forbids, so sign-in fails.

Question 3

You have two management groups named MG1 and MG2 that contain multiple Azure subscriptions. The subscriptions are linked to a Microsoft Entra tenant.

You have a user named User1 and a global administrator named Admin1.

You are informed that User1 created an Azure subscription named Sub1 under the MG2 management group and is the only owner of the subscription.

You need to ensure that Admin1 can remove the Owner role from User1 for Sub1.

What should you do first?

  1. Move Sub1 to MG1.
  2. Assign Admin1 the User Access Administrator role for Sub1.
  3. Instruct Admin1 to use Privileged Identity Management (PIM) to request the Security Administrator role.
  4. Instruct Admin1 to enable Access management for Azure resources.
Show answer and explanation

Correct answer: D. Instruct Admin1 to enable Access management for Azure resources.

Azure resources. A Global Administrator has no Azure RBAC permission over subscriptions by default, which is why Admin1 cannot touch the Owner assignment. Enabling Access management for Azure resources elevates the Global Administrator and assigns them User Access Administrator at the root scope, covering every management group and subscription in the tenant. From there Admin1 can manage role assignments on Sub1.

Why the other options are wrong

  • A. Moving Sub1 between management groups changes where it sits in the hierarchy but grants Admin1 no permission over it.
  • B. Assigning that role on Sub1 requires someone who already has role-assignment rights there, and User1 is the only owner. This is the problem, not the fix.
  • C. Security Administrator is a Microsoft Entra role. It carries no Azure RBAC write permission over subscriptions.

Question 4

You have a management group named MG1 that contains two subscriptions named Sub1 and Sub2.

Sub1 contains a resource group named RG-Exception and a resource group named RG1 that hosts Microsoft Foundry resources.

You need to assign an Azure policy to force new Foundry deployments in MG1 to use private endpoints. The solution must NOT restrict deployments in RG-Exception.

How should you configure the policy?

  1. Assign the policy to MG1 and exclude RG-Exception.
  2. Assign the policy to Sub1 and RG-Exception.
  3. Assign the policy to MG1 and RG-Exception.
  4. Assign the policy to Sub1 and exclude RG-Exception.
Show answer and explanation

Correct answer: A. Assign the policy to MG1 and exclude RG-Exception.

Assigning the policy at the management group means it flows down to every subscription and resource group under MG1, including ones created later. An exclusion on R-xception carves that single scope out of the assignment, so deployments there are unaffected while everything else is forced onto private endpoints.

Why the other options are wrong

  • B. Assigning to Sub1 covers only that subscription and misses Sub2 and any future subscription. Naming RG-Exception as a target enforces the policy there rather than exempting it.
  • C. Adding RG-Exception as an assignment scope applies the policy to it. Exclusion, not assignment, is what exempts a scope.
  • D. The exclusion is right but the scope is wrong. Assigning at Sub1 leaves the rest of MG1 unprotected.

Question 5

You have an Azure key vault named KV1 that uses role-based access control (RBAC) authorization. KV1 stores database connection strings for an Azure App Service web app named App1.

You enable a firewall on KV1 and allow access to KV1 from only the virtual network that contains App1.

You need to ensure that App1 can retrieve secrets from KV1 without using credentials stored in the application configuration.

What should you create?

  1. an access policy for KV1
  2. an app registration for App1
  3. a private endpoint for KV1
  4. a managed identity for App1
Show answer and explanation

Correct answer: D. a managed identity for App1

A managed identity gives App1 an identity in Microsoft Entra ID that Azure manages, with no secret stored anywhere in the app configuration. App1 requests a token for Key Vault with that identity and reads the secret, which is what the credential-free requirement demands. The firewall already permits the app virtual network, so network access is not the missing piece.

Why the other options are wrong

  • A. KV1 uses RBAC authorization, so access policies are not in effect. An access policy also does nothing about where credentials are stored.
  • B. An app registration needs a client secret or certificate that lives in the application configuration, which is the exact thing being eliminated.
  • C. A private endpoint changes the network path to KV1. Traffic from the virtual network is already allowed, and a network path is not an identity.

Question 6

You have a Microsoft Entra tenant that has user consent for applications disabled.

You register an application named App1 that requests the following Microsoft Graph delegated permissions:

• User.Read

• Mail.Read

You need to configure tenant permissions to meet the following requirements:

Enable users to grant consent for low-risk permissions without administrator interaction.

Ensure that applications requesting higher-privilege permissions require administrator approval.

What should you do?

  1. Grant tenant-wide admin consent to App1.
  2. Configure application assignments for App1.
  3. Configure Privileged Identity Management (PIM) role assignments.
  4. Create an app consent policy.
Show answer and explanation

Correct answer: D. Create an app consent policy.

An app consent policy defines which permissions users are allowed to consent to on their own and which ones must be escalated to an administrator. Classifying low-risk delegated permissions lets users self-consent, while anything outside that classification falls through to the admin consent workflow. One policy delivers both halves of the requirement and applies tenant-wide rather than to a single app.

Why the other options are wrong

  • A. Tenant-wide admin consent approves permissions for App1 alone. It sets no rule for other applications and does not let users consent to anything.
  • B. Application assignments decide which users may use an app. They have no effect on what permissions can be consented to.
  • C. PIM governs privileged directory and Azure role activation, not application permission consent.

Question 7

You have an Azure management group named MG1 that contains two subscriptions named Sub1 and Sub2. Both subscriptions are linked to a Microsoft Entra tenant that contains a security group named Group1.

You need to ensure that the members of Group1 can assign roles to the resources in Sub1 and Sub2. The solution must follow the principle of least privilege.

Which role should you assign to Group1?

  1. Contributor at the MG1 scope
  2. Contributor at the Sub1 and Sub2 scopes
  3. User Access Administrator at the MG1 scope
  4. Owner at the MG1 scope
Show answer and explanation

Correct answer: C. User Access Administrator at the MG1 scope

Assigning roles requires the Microsoft.Authorization/roleAssignments/write permission, which User Access Administrator carries and Contributor does not. Granting it at MG1 covers both Sub1 and Sub2 in a single assignment. It is the least privileged built-in role that can delegate access, since it adds no rights to manage the resources themselves.

Why the other options are wrong

  • A. Contributor can create and manage resources but is explicitly denied role assignment permissions at any scope.
  • B. Contributor still cannot assign roles, and splitting it across two subscriptions adds administrative overhead without adding the missing permission.
  • D. Owner would work but bundles full resource management with role assignment, which exceeds what the task requires.

Question 8

Show the case study this question is based on

Overview

Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.

Existing Environment. Network environment

The on-premises network contains a datacenter in each office.

Existing Environment. Cloud environment

Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.

All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.

Existing Environment.

Sub1 Resources

Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.

Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:

• Bot Manager 1.1

• Azure-managed Default Rule Set (DRS)

Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:

• NIST SP 800-53 Rev. 4

• Microsoft cloud security benchmark (MCSB)

• System and Organization Controls (SOC) 2 Type 2

• Existing Environment. Sub2 Resources

Sub2 contains a resource group named RG2.

Planned Changes and Requirements. Planned Changes

Fabrikam plans to implement the following changes:

Deploy the following key vaults to RG1:

• AKV2 in the West Europe Azure region

• AKV3 in the Central US Azure region

AKV4 in the East US Azure region Deploy the following key vaults to RG2:

AKV5 in the East US region –

Configure VM1 to read data from storage1.

Create function apps that have the following hosting plans:

• Fa1: Flex Consumption hosting plan

• Fa2: Consumption hosting plan

• Fa3: Dedicated hosting plan

For WAF1, implement rate limiting rules based on the request location.

Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud.

Create a new storage account named storage2 that supports Azure Table storage.

Enforce multifactor authentication (MFA) when database administrators access SQLdb1.

Implement ExpressRoute circuits to the on-premises network as shown in the following table.

For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.

Planned Changes and Requirements. Technical Requirements

Fabrikam has the following technical requirements:

If VM1 is deleted, the permissions for VM1 must be removed automatically.

The AKS1 managed identity must only be able to pull images from Registry1.

The ID1 managed identity must be able to push images to and pull images from Registry1.

All the data in the storage accounts must be encrypted by using Fabrikam-managed keys.

All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits.

ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption.

You need to implement the planned change for storage2. The solution must meet the technical requirements for storage encryption.

What should you do?

Exhibit for question 8

Exhibit for question 8

Exhibit for question 8

  1. Enable purge protection for storage2.
  2. Create an encryption scope in storage2.
  3. Configure storage2 to use an account encryption key.
  4. Assign an Azure role-based access control (Azure RBAC) role to storage2.
Show answer and explanation

Correct answer: C. Configure storage2 to use an account encryption key.

Fabrikam-managed keys means customer-managed keys, and for a storage account those are applied by pointing the account encryption key at a key held in Key Vault. That setting encrypts every service in the account, which matters here because storage2 is being created for Azure Table storage.

Why the other options are wrong

  • A. Purge protection is a Key Vault setting and a prerequisite for using custome-anaged keys. It is not itself the encryption configuration, and it is not applied to a storage account.
  • B. Encryption scopes apply only to blob containers and individual blobs. They cannot be used for Table storage.
  • D. An Azure RBAC role controls who can reach the data. It has no effect on which key encrypts it.

Question 9

You have an Azure SQL Database logical server named Server1 that contains multiple databases.

The databases contain legacy SQL authentication logins that must no longer be usable for sign-in but must NOT be removed from the databases.

You need to ensure that SQL authentication is denied for connections.

What should you do?

  1. Run create USER … FROM EXTERNAL PROVIDER on each database.
  2. Create a Conditional Access policy.
  3. Enable Microsoft Entra-only authentication for Server1.
  4. Assign the SQL Server Contributor role to Server1.
Show answer and explanation

Correct answer: C. Enable Microsoft Entra-only authentication for Server1.

Server1. Enabling Microsoft Entra-only authentication on Server1 makes the server reject all SQL authentication connections while leaving the legacy logins present in the databases. The accounts remain for auditing and future reference but can no longer be used to sign in, which is exactly the split the requirements describe.

Why the other options are wrong

  • A. Creating users from an external provider adds Microsoft Entra principals to a database. It does not block the SQL logins that already exist.
  • B. Conditional Access evaluates Microsoft Entra sign-ins. SQL authentication never reaches Entra, so no policy can be applied to it.
  • D. SQL Server Contributor is a management-plane role for administering the server resource, not a control over authentication methods.

Question 10

You have an Azure subscription named Sub1 that contains an Azure Database for PostgreSQL instance. Sub1 has Microsoft Defender for Cloud enabled.

You need to configure Microsoft Defender for Databases to minimize costs.

Which Defender plan should you enable?

  1. Microsoft Defender for Servers
  2. Microsoft Defender for Open-Source Relational Databases
  3. Microsoft Defender for SQL Servers on Machines
  4. Microsoft Defender for Azure SQL Databases
  5. Microsoft Defender for Storage
Show answer and explanation

Correct answer: B. Microsoft Defender for Open-Source Relational Databases

Databases Azure Database for PostgreSQL is an open-source relational engine, so Microsoft Defender for Open-Source Relational Databases is the plan built for it. It is the narrowest plan that covers the workload, which keeps cost to a minimum because no other resource type is enrolled.

Why the other options are wrong

  • A. Defender for Servers protects virtual machines and is billed per server. It does not cover a PaaS database.
  • C. Defender for SQL Servers on Machines covers SQL Server installed on virtual machines, not managed PostgreSQL.
  • D. Defender for Azure SQL Databases covers Azure SQL Database and SQL Managed Instance only.
  • E. Defender for Storage protects storage accounts and has no database coverage.

That was 10 of 121.

The full Microsoft SC-500 pack has all 121 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack