Cloud and AI Security Engineer Associate (SC-500) - Full Practice Exam 1

1. A container platform needs supported detection of configuration weaknesses and runtime risks. Which security product should be evaluated?
2. A deployIfNotExists assignment must remediate existing noncompliant resources. Which two elements should be checked? Select TWO.
3. A design evaluates agentless scanning alongside endpoint detection and response. Which distinction is important?
4. A Foundry agent can call a consequential business tool. Which two controls reduce the impact of an incorrect or manipulated model decision? Select TWO.
5. A large network estate needs centrally governed security rules across supported VNets while local teams maintain their NSGs. Which capability should be evaluated?
6. A matching NSG deny rule has priority 100 and a matching allow rule has priority 200. Which applies to a new connection?
7. A network inspection design requires supported TLS inspection and intrusion detection/prevention in Azure Firewall. Which tier should be evaluated?
8. A private endpoint exists for a PaaS resource, but connected clients use the public address from DNS. Which design element should be fixed?
9. A private-only storage design has a private endpoint but retains unrestricted public network access. Which concern remains?
10. A provider wants eligible consumers to reach its supported private load-balanced service through consumer private endpoints. Which provider-side feature fits?
11. A public HTTP application needs supported protection against injection and cross-site scripting patterns. Which control is directly relevant?
12. A recommendation should start an authorized remediation workflow. What controls should the automation include?
13. A regulatory compliance dashboard reports noncompliance for a resource control. What is the appropriate next step?
14. A remediation closes one finding but breaks a production dependency. What should the security process improve?
15. A security engineer needs a consolidated view of cloud misconfigurations and supported workload protection status. Which service should be reviewed?
16. A security scan discovers an active credential in a workload's files. Which response is necessary beyond removing the file content?
17. A service should read blobs through Entra authentication but must not modify them. Which role concept fits?
18. A storage account has a CanNotDelete management lock. A team assumes this prevents every blob deletion through the data API. What should be explained?
19. A storage estate needs supported threat detection and applicable malware scanning capabilities. Which product should be evaluated?
20. A supported Azure service must obtain tokens for another Azure resource without storing an application password. Which identity approach fits?
21. A supported VM requires a stronger boot integrity foundation. Which security type and features should be evaluated?
22. A team expects workload-specific detections, but the relevant Defender plan has not been enabled and prerequisites are missing. What should be checked?
23. A team must reduce the risk that a deleted encryption key is immediately and permanently destroyed. Which vault protections should it evaluate?
24. A team prioritizes every recommendation solely by its contribution to secure score. What additional factor should guide remediation order?
25. A vault private endpoint is configured, but the application cannot retrieve secrets after public access is disabled. What should be checked?
26. Administrative ports on VMs should be opened only for authorized requests and limited periods. Which capability should be evaluated?
27. Administrators need supported RDP or SSH management without public IPs and exposed management ports on each target VM. Which service fits?
28. AKS workloads should access eligible Azure resources without a shared secret embedded in every Pod. Which capability should be evaluated?
29. An App Service-hosted API requires supported sign-in integration and appropriate application authorization. Which approach fits?
30. An enterprise application requests broad organizational API permissions. What should be evaluated before granting consent?
31. An exposed external API secret is removed from source control. What must still be done?
32. An external process needs temporary read access to a specific storage object. Which delegation design best limits exposure?
33. An identity can manage a Key Vault resource but cannot retrieve secrets through its data API. Which distinction matters?
34. An organization must block new noncompliant storage configurations at deployment time. Which Azure Policy effect should be considered when applicable?
35. An organization wants AI agents to have identifiable, governable workload identities rather than use one employee's credentials. Which capability should it evaluate?
36. An organization wants supported visibility for another-cloud workloads in Defender for Cloud. What should the connector design enforce?
37. Backup operators should not be able to silently destroy all recovery history after their credentials are compromised. Which design should be evaluated?
38. Copilot makes an accidentally overshared SharePoint document easier to discover. What should security remediate?
39. Investigators need resource operation evidence in a central analysis destination. Which configuration should be evaluated?
40. Production administrators should activate Azure privileges only during an approved maintenance window. Which control best reduces standing access?
41. Security controls must extend to supported on-premises and other-cloud servers. Which onboarding approach should be evaluated?
42. Security must retain supported Azure SQL activity evidence for investigation. Which feature should be configured with an appropriate destination and retention design?
43. Security needs a centralized view of supported data and AI resources, associated risks, and protection status. Which dashboard should it evaluate?
44. Security wants NSG rules based on logical application tiers rather than listing every VM's private IP. Which capability fits?
45. Selected SQL columns must remain encrypted from the perspective of the database engine, with decryption by authorized clients. Which capability should be evaluated?
46. Sensitive application access must require an approved authentication strength and device conditions. Which capability should be configured?
47. Several AI applications need centrally enforced API authentication, token or request policies, and usage telemetry where supported. Which service capability should be evaluated?
48. Several individually moderate weaknesses combine into a path to sensitive data. Which analysis is most useful?
49. Staff need identity-centric access to specified private applications without broad access to every internal network resource. Which service should be considered?
50. Users share one application table but may see only their organization's rows. Which database control should be evaluated?

Comments — 0