Microsoft SC-500 Practice Exam Questions & Answers

To ensure that access from Subnet1 to storage1 uses a private IP address and can be filtered by NSG1, with public network access disabled, you should create a private endpoint for the blob service (or storage service).

A private endpoint provides:

• A private IP address within Subnet1 for accessing storage1
• Traffic that stays within the Azure backbone network and does not traverse the public internet
• Integration with NSG1, allowing you to create NSG rules to filter traffic to the private endpoint
• The ability to disable public network access to storage1 while maintaining internal connectivity

After creating the private endpoint, you would disable public network access on storage1 and configure NSG1 rules to permit or deny traffic to the private endpoint IP address as needed.

A user delegation SAS is the best choice because the requirement specifically calls for time-bound, least-privilege access to Azure Blob Storage. A SAS can be restricted to the exact resource, permissions, and validity period required. For example, the token can grant only the permissions needed to upload blobs and can be configured with a defined expiration time. Microsoft recommends using a user delegation SAS whenever possible because it is secured with Microsoft Entra credentials instead of the storage account key. Microsoft Learn

This is more secure than Shared Key authorization, which relies on storage account keys that provide broad access and are harder to constrain safely. Microsoft explicitly recommends avoiding Shared Key when more secure Microsoft Entra-based approaches are available. Microsoft Learn

A managed identity would be ideal for a workload hosted on an Azure service that supports managed identities, but the question describes a third-party workflow system and emphasizes temporary delegated access. A user delegation SAS directly satisfies that use case. Anonymous public access is inappropriate because it does not provide controlled authenticated upload access.

Therefore, the correct authorization mechanism is a user delegation SAS.

Adding virtual machines to a security group does not by itself grant Azure Storage access. The authorization principal used by Azure RBAC must be the managed identity or another supported security principal that the workload uses to request tokens. The solution also fails to state that the system-assigned managed identities are added to the group. Because the compute resources themselves are not the authenticating principals, this solution does not meet the goal. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure RBAC and identities; Microsoft Learn > role assignment requires an identity principal at the scope.

To identify Azure configurations and workloads that are non-compliant with ISO 27001:2013 standards, you should use Microsoft Defender for Cloud compliance assessments.

Defender for Cloud provides:

• Built-in compliance standards assessments, including ISO 27001:2013
• Automated scanning of Azure resources against regulatory standards
• Detailed compliance reports showing which resources are compliant or non-compliant
• Recommendations for remediating non-compliant configurations
• Regulatory compliance dashboard to track compliance posture

The compliance assessments feature in Defender for Cloud evaluates your Azure environment against various regulatory frameworks and industry standards. For ISO 27001:2013, it will identify any configurations or workloads that deviate from the standard's requirements and provide remediation guidance.

A SharePoint Advanced Management Data access governance report is specifically designed to identify SharePoint content that is broadly accessible across the organization. In particular, SharePoint provides reports for content shared with Everyone except external users (EEEU) and Everyone. EEEU automatically includes all internal users, making this report directly applicable when investigating content that Microsoft 365 Copilot could surface to employees because of overly broad SharePoint permissions.

Microsoft states that Data access governance reports help organizations detect oversharing, analyze permission exposure, and identify sites and files whose current permissions allow excessive internal access. This is especially relevant before or during Copilot adoption because Copilot honors existing user permissions: broadly accessible SharePoint content can therefore appear in Copilot-powered experiences for users who already have permission to access it.

A Purview DLP policy detects and governs sensitive-data handling but does not provide the required inventory of content shared with all internal users. A DSPM remediation action is intended to remediate identified risks rather than produce this specific SharePoint permission report. Conditional Access controls authentication conditions and does not analyze SharePoint permissions.

The SC-500 study guide explicitly includes identifying overexposure of data in SharePoint under Secure compute and AI security.

A user-assigned managed identity can be attached to multiple virtual machines and then granted an Azure Storage data role. The applications running on VM1 and VM2 can request tokens for that identity and access storage1 without account keys. Public network access is already enabled, so the missing control is authorization. Assigning the user-assigned managed identity to the correct storage role satisfies the access requirement. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > managed identities; Microsoft Learn > user-assigned managed identities and role assignment to storage.

To use Microsoft Authenticator as a primary authentication method, Group1 must be enabled for passwordless authentication. Passwordless phone sign-in allows users to authenticate directly by using Microsoft Authenticator instead of first supplying a password. Microsoft describes Authenticator passwordless sign-in as a primary sign-in method in which the user approves a number challenge and then completes biometric or PIN verification on the registered device.

The Microsoft Entra Authentication methods policy supports targeting specific users and groups and controlling whether they can use Authenticator for push MFA, passwordless authentication, or both. Enabling the passwordless mode for Group1 therefore directly meets the stated requirement.

Push authentication is primarily used as an MFA verification mechanism and does not by itself make Authenticator the user's primary authentication method. One-time passcodes are also verification codes used for MFA scenarios rather than passwordless primary sign-in. Revoking sessions simply forces users to authenticate again and does not enable a new authentication method.

The SC-500 study guide explicitly includes implementing and configuring authentication methods, including MFA and passwordless authentication, under the Manage identity, access, and governance domain.