Try 10 focused Microsoft SC-500 questions on Secure Compute, with explanations, then continue with IT Mastery.
Open the matching IT Mastery practice page for timed mocks, topic drills, progress tracking, explanations, and full practice.
Try Microsoft SC-500 on Web View full Microsoft SC-500 practice page
| Field | Detail |
|---|---|
| Exam route | Microsoft SC-500 |
| Topic area | Secure Compute |
| Blueprint weight | 24% |
| Page purpose | Focused sample questions before returning to mixed practice |
Use this page to isolate Secure Compute for Microsoft SC-500. Work through the 10 questions first, then review the explanations and return to mixed practice in IT Mastery.
| Pass | What to do | What to record |
|---|---|---|
| First attempt | Answer without checking the explanation first. | The fact, rule, calculation, or judgment point that controlled your answer. |
| Review | Read the explanation even when you were correct. | Why the best answer is stronger than the closest distractor. |
| Repair | Repeat only missed or uncertain items after a short break. | The pattern behind misses, not the answer letter. |
| Transfer | Return to mixed practice once the topic feels stable. | Whether the same skill holds up when the topic is no longer obvious. |
Blueprint context: 24% of the practice outline. A focused topic score can overstate readiness if you recognize the pattern too quickly, so use it as repair work before timed mixed sets.
These questions are original IT Mastery practice items aligned to this topic area. They are designed for self-assessment and are not official exam questions.
Topic: Secure Compute
A security team manages Azure VMs in a subscription protected by Microsoft Defender for Servers Plan 2. During a change freeze, production VMs cannot receive new agents or VM extensions, but the team needs vulnerability findings in Defender for Cloud for those VMs.
Current settings
| Setting | Status |
|---|---|
| Defender for Endpoint integration | On |
| Vulnerability assessment extension deployment | Disabled |
| Agentless scanning for machines | Off |
Which configuration change best supports the requirement?
Options:
A. Create a Microsoft Sentinel connector for Defender for Cloud.
B. Enable Agentless scanning for machines for the subscription.
C. Enable automatic deployment of the vulnerability assessment extension.
D. Deploy the Azure Arc Connected Machine agent to each VM.
Best answer: B
Explanation: Agentless VM scanning is managed in Defender for Cloud settings and is designed to discover vulnerabilities from machine disk snapshots without requiring an installed security agent or VM extension. In this scenario, Defender for Servers Plan 2 is already enabled, but agentless scanning is off and production VMs cannot be changed. Turning on agentless scanning aligns with the no-agent constraint while still producing vulnerability discovery signals in Defender for Cloud. Extension-based assessment and endpoint onboarding can provide useful security data, but they depend on installed components or runtime agents. Sentinel ingestion can centralize alerts and logs, but it does not perform the vulnerability scan itself.
Topic: Secure Compute
A subscription contains Azure VMs and Azure Arc-enabled servers protected by Defender for Servers. The security team must surface continuous OS and software vulnerability findings in Defender for Cloud and wants to use the Microsoft-native scanner without deploying a third-party scanner extension. What should you configure?
Options:
A. Enable vulnerability assessment using Microsoft Defender Vulnerability Management.
B. Deploy the Qualys vulnerability assessment extension by policy.
C. Enable only agentless scanning for machines in Defender CSPM.
D. Connect Defender for Cloud alerts to Microsoft Sentinel.
Best answer: A
Explanation: Defender for Servers can provide vulnerability assessment results for protected server workloads by using Microsoft Defender Vulnerability Management. This is configured from the Defender for Servers plan settings as the vulnerability assessment option, so findings appear in Defender for Cloud recommendations without requiring a third-party scanner extension. Agentless scanning can provide useful posture visibility, but it is not the same as configuring the Microsoft-native vulnerability assessment path for the protected Azure and Arc server estate. Sentinel ingestion is for monitoring and correlation, not scanning configuration.
Topic: Secure Compute
A security engineer onboarded several on-premises Linux servers to Azure Arc so the servers can be governed by Azure security services in Microsoft Defender for Cloud. Which evidence best validates that the intended security control is working?
Options:
A. The Azure virtual machines inventory lists the servers as native Azure VMs
B. Azure Monitor shows heartbeat data from the servers in a Log Analytics workspace
C. Microsoft Entra sign-in logs show administrators accessing the Azure portal
D. Defender for Cloud lists the servers as Arc-enabled resources with server recommendations
Best answer: D
Explanation: Azure Arc extends Azure management and security governance to servers that run outside Azure, such as on-premises or other-cloud machines. For this objective, the best validation is evidence that Defender for Cloud recognizes those machines as Arc-enabled server resources and applies security assessment or recommendations to them. That confirms both required parts: the non-Azure resource boundary is handled through Azure Arc, and Azure security services are actively governing the server. A heartbeat only proves telemetry is being sent, and portal sign-in activity only proves administrator access, not server protection or governance.
Topic: Secure Compute
An organization runs several Azure Kubernetes Service (AKS) clusters. A security review identifies a container posture concern: some running workloads might be configured with privileged mode or risky host mounts. There is no evidence of active exploitation, and the team wants built-in Microsoft recommendations that detect these workload misconfigurations. Which mechanism should the team use?
Options:
A. Azure WAF managed rules for ingress traffic
B. Defender for Containers workload recommendations
C. Microsoft Sentinel analytics rules for pod logs
D. Defender for Servers EDR on AKS nodes
Best answer: B
Explanation: Defender for Containers is the Microsoft Defender for Cloud plan used for Kubernetes and container workload security. When the issue is posture risk in container workloads, such as privileged containers or risky host mounts, the relevant signal is the container-specific recommendations and hardening findings produced by Defender for Containers. These recommendations help security engineers identify misconfigurations before they become exploitable paths.
Sentinel analytics are useful for correlating logs and detecting suspicious activity, but they are not the primary posture assessment mechanism. WAF protects HTTP application traffic, and Defender for Servers focuses on server and VM protection rather than Kubernetes workload configuration.
Topic: Secure Compute
A security engineer reviews Microsoft Defender for Cloud findings for an AKS-hosted payment workload. The team needs to determine whether the finding is a container posture issue and what to do next.
Exhibit: Defender for Cloud recommendation
| Field | Value |
|---|---|
| Plan/source | Defender for Containers |
| Resource | aks-prod/payments-api |
| Recommendation | Containers should run with a restricted security context |
| Evidence | privileged=true; allowPrivilegeEscalation=true |
| Status | Unhealthy |
| Runtime alert | None |
What is the best next action?
Options:
A. Enable Defender for Servers on the AKS node VMs.
B. Update the workload security context to disable privileged execution.
C. Add an NSG rule to block inbound Internet traffic.
D. Connect AKS logs to Microsoft Sentinel before remediation.
Best answer: B
Explanation: Defender for Containers surfaces posture recommendations for container workloads, including unsafe Kubernetes security-context settings. In the exhibit, privileged=true and allowPrivilegeEscalation=true indicate that the workload can run with elevated container privileges. The absence of a runtime alert does not make the finding informational; the Unhealthy status means Defender for Cloud detected a configuration risk that should be remediated in the workload manifest or deployment configuration. The appropriate response is to disable privileged execution, prevent privilege escalation, redeploy, and verify that the recommendation becomes healthy.
Topic: Secure Compute
A company runs Windows and Linux servers in an on-premises datacenter. The servers cannot be migrated to Azure, but security must manage them with Azure Policy compliance assignments and Microsoft Defender for Cloud server protections from the same Azure governance scope used for cloud VMs. Which implementation should the security engineer use?
Options:
A. Connect the servers to Microsoft Sentinel by using only syslog collection.
B. Replicate the servers to Azure with Azure Site Recovery.
C. Onboard with Azure Arc, then apply Azure Policy and Defender for Servers.
D. Create private endpoints for the servers in an Azure virtual network.
Best answer: C
Explanation: Azure Arc-enabled servers extend Azure management and security controls to supported non-Azure Windows and Linux machines. Installing the Azure Connected Machine agent on each server onboards it as an Azure resource, which lets the organization assign Azure Policy, evaluate compliance, and apply Microsoft Defender for Cloud protections such as Defender for Servers without migrating the workloads. This preserves the operational constraint that the servers remain on-premises while still bringing them under Azure governance. Log collection, private connectivity, or disaster recovery replication can support other goals, but they do not make the current non-Azure servers manageable as Azure-governed server resources.
Topic: Secure Compute
An organization uses Azure AI services for a customer-facing application. Security leadership wants workload protection that can detect threats against the AI service while allowing the application to continue calling the service normally. Which control should the security engineer implement?
Options:
A. Enable only Defender CSPM for the subscription.
B. Create a Sentinel rule for AI logs only.
C. Add Foundry guardrails for prompt filtering.
D. Enable Defender for AI Service in Defender for Cloud.
Best answer: D
Explanation: Defender for AI Service is the Defender for Cloud workload protection plan intended for AI services that need threat detection and protection coverage. In this scenario, the requirement is not merely to assess posture, filter prompts, or build custom monitoring after log ingestion; it is to protect the AI workload itself while preserving normal application behavior. Enabling the Defender for AI Service plan in Cloud Workload Protection provides the appropriate control boundary for that need. Foundry guardrails and Sentinel analytics can be useful in related designs, but they do not replace enabling the workload protection plan for AI services.
Topic: Secure Compute
A team has deployed a Microsoft Foundry chat application. Security review finds that client apps call the model endpoint directly, so the team cannot centrally enforce caller authentication, request throttling, or request/response policy checks before traffic reaches the Foundry endpoint. What is the best next hardening step?
Options:
A. Review the Data and AI security dashboard.
B. Enable Defender for AI Service for the workload.
C. Place the app behind AI Gateway in Azure API Management.
D. Configure Foundry guardrails for the model deployment.
Best answer: C
Explanation: AI Gateway in Azure API Management is used when the security need is to broker and control application traffic before it reaches Microsoft Foundry. In this scenario, the gap is direct endpoint access without centralized authentication, throttling, and request/response policy enforcement. Defender for AI Service helps protect AI workloads by detecting threats and risks, Foundry guardrails help constrain AI behavior and safety within Foundry, and the Data and AI security dashboard provides monitoring and posture visibility. Those are useful controls, but they do not replace the need for a gateway front door when the immediate problem is unmanaged client-to-endpoint traffic.
Topic: Secure Compute
A server team deployed an Azure VM named vm-app01 by using a supported Generation 2 image, but the VM is currently running with Security type: Standard. Defender for Cloud flags that Secure Boot is disabled, and the workload owner requires trusted boot protection before production release. What should you do next?
Options:
A. Enable Azure Bastion for administrative access.
B. Apply an Azure Machine Configuration baseline.
C. Enable disk encryption with a customer-managed key.
D. Deallocate the VM, set Trusted launch, and enable Secure Boot.
Best answer: D
Explanation: Azure VM Secure Boot is part of the Trusted launch security model. Because vm-app01 is a supported Generation 2 VM but still uses the Standard security type, the logical next step is to move it to Trusted launch and enable Secure Boot. Deallocating the running VM is the appropriate implementation sequence before changing this security configuration. Secure Boot helps protect the boot chain from unsigned or tampered boot components; related capabilities such as vTPM and integrity monitoring build on the same trusted launch foundation. Controls such as Bastion, Machine Configuration, and disk encryption improve other security areas but do not satisfy the trusted boot requirement.
Topic: Secure Compute
A security engineer reviews a deployed Microsoft Copilot Studio agent after a Defender XDR blast-radius alert. The business owner confirms the agent should answer only benefits FAQ questions.
Agent: BenefitsHelper
Finding: Agent can read HR-Performance site
Evidence source: Microsoft Entra Agent ID access graph
Runtime protection alerts: None
Recent blocked prompts or tools: None
What is the best next implementation step?
Options:
A. Re-scope the agent identity’s HR-Performance access in Microsoft Entra Agent ID.
B. Disable all Copilot Studio agents across the tenant.
C. Add a Copilot Studio runtime rule to block HR prompts.
D. Ingest all agent transcripts into Microsoft Sentinel first.
Best answer: A
Explanation: Defender XDR blast-radius evidence from Microsoft Entra Agent ID indicates an identity and access issue: the agent identity can reach a resource outside its business purpose. The next step is to reduce that identity’s permissions or assignments and validate least privilege. Microsoft Copilot Studio runtime protection is relevant when the evidence involves malicious prompts, unsafe tool calls, or runtime policy violations, but the exhibit shows no runtime alerts. Monitoring or tenant-wide shutdowns either delay risk reduction or over-remediate. Match the remediation plane to the evidence source.
Use the Microsoft SC-500 Practice Test page for the full IT Mastery practice bank, mixed-topic practice, timed mock exams, explanations, and web/mobile app access.
Try Microsoft SC-500 on Web View Microsoft SC-500 Practice Test
Read the Microsoft SC-500 Cheat Sheet for compact concept review before returning to timed practice.