6.3. Practice Questions

Question 1 (Domain 2 — Identity/Governance)

A security engineer needs Global Administrator permissions activated only when performing tenant-wide configuration changes, with approval required from a designated approver and automatic expiry after 4 hours. What should they configure?

A) A Conditional Access policy requiring MFA for Global Administrator B) A Privileged Identity Management eligible assignment with approval and a 4-hour activation duration C) A custom Microsoft Entra role with a 4-hour session timeout D) An Azure Policy definition restricting Global Administrator actions

Correct answer: B. PIM eligible assignments are exactly this mechanism — activation on demand, with approval and a bounded duration, reverting automatically. Conditional Access (A) governs how someone authenticates, not the standing-versus-time-bound nature of the role itself. Azure Policy (D) governs resource configuration, not Entra role activation.

Question 2 (Domain 2 — Governance)

An organization's Contributor-level engineers keep accidentally deploying storage accounts without encryption enabled, despite training. Which control most directly prevents this going forward, regardless of who deploys the resource?

A) A custom RBAC role with fewer permissions than Contributor B) An Azure Policy definition with a Deny effect requiring encryption C) A resource lock set to ReadOnly on the resource group D) An Access Review scheduled quarterly for the Contributor role

Correct answer: B. A Deny-effect Policy blocks the non-compliant deployment outright, independent of who has RBAC permission to deploy. A ReadOnly lock (C) would block ALL modifications, not just non-compliant ones, breaking normal operations. Access Reviews (D) address stale access, not deployment-time configuration.

Question 3 (Domain 3 — Storage/Networking)

A storage account has network firewall rules restricting access to a single virtual network, yet a security review finds it's still accessible from an unexpected external location. What is the most likely cause?

A) The storage account's encryption at rest is misconfigured B) A SAS token with broad permissions and a long expiry is still active C) The storage account needs Defender for Storage enabled D) The virtual network's NSG rules are too permissive

Correct answer: B. Firewall rules restrict network paths, but a valid SAS token is a bearer credential usable by anyone holding it, independent of network restrictions on the account itself — this is the two-independent-gates principle from 3.1. Defender for Storage (C) would detect suspicious activity but doesn't explain unauthorized reachability by itself.

Question 4 (Domain 3 — Networking)

A central security team wants to guarantee that a specific deny rule applies to all VNets in a subscription, even overriding a locally-configured NSG allow rule set by a resource owner. Which capability should they use?

A) Azure Firewall application rules B) Network Watcher effective security rules C) Azure Virtual Network Manager security admin rules D) A more restrictive default NSG template

Correct answer: C. Security admin rules are specifically designed to be centrally managed and capable of overriding local NSG configuration. Network Watcher (B) is diagnostic — it shows the effective outcome but doesn't enforce anything itself.

Question 5 (Domain 4 — AI Security)

A Copilot deployment surfaces a sensitive financial document to a user during a chat session. Investigation confirms the user's SharePoint permissions technically allowed access to that document already. Is this a security incident, and what control would have flagged the underlying risk in advance?

A) Not a security issue — permissions were correct, so no control was needed B) Yes — Purview DSPM for AI should have flagged the oversharing risk before Copilot was enabled broadly C) Yes — this indicates a Conditional Access policy gap D) Not a security issue — this is expected Copilot behavior and requires no review

Correct answer: B. This is the exact oversharing scenario described in 4.1.1 — technically-correct permissions becoming a real exposure risk once AI can discover them at scale. Conditional Access (C) governs sign-in context, not content discoverability.

Question 6 (Domain 4 — Compute/AI)

An organization wants to prevent unbounded API costs from an AI agent making excessive calls to a Foundry model endpoint, while separately ensuring any prompt injection attempts are filtered before reaching the model. Which two controls together address both requirements?

A) Defender for AI Service and Azure Policy B) AI Gateway in API Management (rate limiting) and Foundry guardrails (content filtering) C) Entra Agent ID Conditional Access and Azure Bastion D) Defender CSPM and Azure Firewall

Correct answer: B. The AI Gateway governs traffic-layer concerns like rate limiting and cost control; Foundry guardrails govern content and behavior filtering including prompt injection — exactly the layered distinction covered in 4.1.4-4.1.5.

Question 7 (Domain 5 — Posture/Monitoring)

A Defender for Cloud dashboard shows three separate low-severity findings on the same internet-facing VM: a missing patch, excessive network exposure, and an overprivileged managed identity. Individually each is rated low priority. What capability would correctly flag this combination as higher risk?

A) Defender Vulnerability Management scanning B) Defender CSPM attack path analysis C) Microsoft Sentinel automation rules D) Azure Policy compliance evaluation

Correct answer: B. Attack path analysis specifically identifies compounding risk from combinations of findings, exactly as described in 5.1.1 — treating them as one elevated risk rather than three isolated low-priority items.

Question 8 (Domain 5 — Sentinel)

A Sentinel automation rule is configured to trigger when a high-severity incident is created. The engineer wants it to first assign an owner, then run a playbook to isolate the affected host, then run a second playbook to notify the security team. What correctly describes this configuration?

A) Three separate automation rules, one per action B) One automation rule invoking a sequence of actions including two playbooks C) A single playbook containing all three actions D) A data connector configured with three triggers

Correct answer: B. Automation rules define the orchestration and sequence; playbooks are the individual automated actions they invoke — a single rule can call multiple playbooks in order, exactly as described in 5.2.3.

⚠️ Exam Trap: Notice how many of these correct answers hinge on recognizing which layer a control operates at (network vs. identity, traffic vs. content, prevention vs. detection) rather than simply naming a service. That pattern — not raw memorization — is what SC-500 is actually testing.