Microsoft SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Security operations

   A security operations team wants to correlate sign-in logs, endpoint alerts and cloud activity in one place, with analytics rules that create incidents. Which service fits?

   1. AAzure Cost Management
   2. BAzure DevOps Boards
   3. CAzure Blob Storage lifecycle policies
   4. DMicrosoft Sentinel
   Show answer and explanationHide answer

   Correct answer: D

   Microsoft Sentinel is a cloud SIEM that collects logs from many sources, runs analytics rules, and creates incidents for investigation. Cost management, storage lifecycle policies and work-tracking boards do not provide security correlation.

2. Question 2Identity and access

   An Azure AI application runs on an App Service and must read secrets from Key Vault without storing any credentials in code or configuration. Which approach is recommended?

   1. AEnable a managed identity on the app and grant it a Key Vault data-plane role such as Key Vault Secrets User
   2. BStore the Key Vault client secret in the app settings of the App Service so the SDK can read it at startup and rotate it manually
   3. CEmbed a shared access signature token with a long expiry directly in the application source code
   4. DGive the app the Owner role at subscription scope so it can manage every resource group and assign roles to other identities
   Show answer and explanationHide answer

   Correct answer: A

   A managed identity with a narrow Key Vault data-plane role lets the app authenticate without any stored credential. Client secrets, embedded tokens and subscription-wide Owner rights each create credentials or privileges that are unnecessary.

3. Question 3Network and workload security

   An AI inference endpoint must be reachable only from the company's virtual network, with no public internet exposure. Which configuration implements this?

   1. APrivate endpoint for the service in the virtual network, with public network access disabled
   2. BA public endpoint secured by a secret URL path with authentication left disabled
   3. CA VPN client configured on each developer laptop to reach the public endpoint with split tunneling enabled
   4. DA public endpoint with an allow list of every employee's home IP address that is maintained manually
   Show answer and explanationHide answer

   Correct answer: A

   A private endpoint gives the service a private address inside the virtual network, and disabling public access prevents internet exposure. Home IP lists are fragile, secret URLs are not a control, and laptop VPNs do not restrict the service itself.

4. Question 4Data and AI protection

   A company wants to discover where sensitive data is stored in its AI workloads and understand which AI interactions expose it. Which Microsoft Purview capability provides this?

   1. AExchange mailbox quotas and archive settings
   2. BData Security Posture Management for AI
   3. CAzure Advisor cost recommendations for disks
   4. DTeams meeting attendance reports by org unit
   Show answer and explanationHide answer

   Correct answer: B

   DSPM for AI in Microsoft Purview identifies sensitive data and shows how AI interactions use it, which supports risk reduction. Mailbox quotas, cost recommendations and attendance reports do not assess data exposure in AI.

5. Question 5Governance and compliance

   A compliance team needs a dashboard of how well Azure resources meet a regulatory benchmark, with the ability to assign remediation tasks. Which feature provides this?

   1. AAzure Cost Management budget page for each subscription with forecast alerts
   2. BA spreadsheet of resource names and owners exported monthly
   3. CRegulatory compliance dashboard in Microsoft Defender for Cloud
   4. DThe Azure portal home page with recent activity and service health status
   Show answer and explanationHide answer

   Correct answer: C

   The regulatory compliance dashboard in Defender for Cloud maps resources to benchmarks and shows gaps with recommended actions. Budget pages, spreadsheets and the home page do not assess compliance against regulatory standards.