SC-500 Implementing End-to-End Security Controls for Cloud and AI Workloads Exam Topics and Questions

Identity is where most Azure breaches begin, and the exam reflects that. This topic covers the full chain from authenticating a human user through Entra ID, to granting a workload a managed identity, to detecting a misconfigured permission with Defender CSPM. The sheer breadth means candidates often know the individual services but stumble when a question crosses two of them, for example when Key Vault access policy intersects with a conditional access requirement.

– Entra ID authentication and conditional access

Entra ID is the authentication backbone for everything else in this topic. You need to know how to secure resource access through Entra ID itself, not just how to create users. Conditional access policies are where access decisions get enforced at runtime: understand the conditions (device compliance, location, sign-in risk) and the grant controls (MFA, compliant device) and know when to block versus when to require a step-up. Authentication methods sit alongside this: the exam distinguishes between MFA configurations and passwordless options such as FIDO2 and Windows Hello for Business. Knowing which method applies to which scenario is more important than being able to list them all. Privileged Identity Management controls how and when elevated roles are activated. PIM's just-in-time activation, approval workflows, and access reviews are all testable, and the exam tends to probe whether you can pick the right PIM setting for a described governance requirement rather than just recall that PIM exists.

– Identity for applications and OAuth

Applications authenticate differently from users, and the exam treats that distinction seriously. Enterprise applications (pre-integrated SaaS) and app registrations (custom apps) have different configuration surfaces, and you need to know which one to reach for in a given scenario. Managed identities remove the need for stored credentials entirely: the exam tests whether you choose system-assigned or user-assigned identities correctly, and whether you understand the scope of what a managed identity can access. OAuth permission grants and consent settings are a common source of over-privilege. Admin consent versus user consent, and the risk of pre-consented broad permissions, are the angles the exam focuses on. Overprivileged access more broadly is tested through Azure RBAC: you should be able to evaluate an access assignment, identify what is excessive, and describe how to remediate it. Custom roles for both Azure and Entra ID are in scope, and the exam will ask you to distinguish between the two role systems and their respective assignment scopes.

– Key Vault operations and secrets security

Key Vault appears in enough sub-topics that it effectively forms its own mini-domain within this topic. Deployment, settings configuration, access control, and firewall configuration are all listed separately, which signals that the exam tests them at a granular level rather than treating Key Vault as a single concept. Access to Key Vault can be granted through vault access policies or Azure RBAC, and the exam expects you to know the difference and when Microsoft recommends one over the other. Firewall settings control which networks and IP ranges can reach the vault, and private endpoint integration is a related control worth knowing. Managing keys, secrets, and certificates includes rotation, expiry, and the difference in how each object type behaves. Defender for Key Vault provides threat detection for suspicious access patterns. Defender CSPM's secrets-scanning capability extends detection to secrets that have leaked outside the vault, for example into a VM disk or a code repository. Both are testable, and candidates often conflate them.

– Governance, policy, and compliance

Azure Policy is the enforcement mechanism for security standards at scale. The exam tests built-in policy definitions as well as custom ones, and you need to understand effect types (deny, audit, deployIfNotExists, modify) because the effect determines what the policy actually does when a resource is non-compliant. Regulatory compliance in Defender for Cloud maps resource configurations against standards such as CIS, NIST, and PCI DSS. The exam asks you to evaluate compliance state and act on recommendations, not just read a dashboard. Security standards and recommendations within Defender for Cloud have a hierarchy: standards define the desired state, recommendations surface individual gaps. Resource locks (CanNotDelete and ReadOnly) are a simpler but frequently tested control: know which operations each lock permits and which it blocks. Infrastructure as code security controls round out this group. The exam expects you to know that IaC scanning can catch misconfigurations before deployment, and that this integrates with Defender for DevOps. Backup protection security features, including immutable vaults and soft delete, are also in scope as a governance-adjacent control.

How Manage identity, access, and governance is tested

With 25 sub-topics, this is the widest topic in the exam. Items rarely test a single service in isolation. The typical pattern is a scenario describing a security requirement, a current configuration, and a gap: you select the control that closes the gap without introducing a new problem. Items on PIM, conditional access, and managed identities tend to reward candidates who can identify the minimal sufficient control, not the most restrictive one. Key Vault items often combine access method (RBAC versus access policy), network restriction (firewall or private endpoint), and a threat detection layer in one scenario. Candidates lose marks by selecting a control that is plausible but applies to the wrong layer, for example choosing a network control when the scenario calls for an identity control. Governance items reward knowing policy effect types precisely: selecting 'audit' where 'deny' is required, or vice versa, is a common trap. RBAC remediation items reward knowing that removing a role assignment is preferable to adding a deny assignment unless the scenario explicitly requires one. Read each scenario for the constraint it places on your answer before you evaluate the options.

After identity, the next line of defence is controlling what authenticated principals can reach and what the platform does when traffic arrives. This topic covers three distinct infrastructure layers: storage, databases, and networking. Each has its own access model, its own threat detection service, and its own set of configuration traps. Candidates who treat these as background knowledge rather than exam material consistently drop marks here, because the questions go well beyond 'enable the firewall' into specific rule types and service interactions.

– Storage account security and threat protection

Storage account security starts with understanding the access hierarchy: account keys, shared access signatures, and Entra ID-based access each carry different risk profiles, and the exam tests which to use in a given scenario. Azure Storage firewall rules restrict access by virtual network or IP range, and the exam expects you to know how the 'Allow Azure services' exception works and when it is appropriate to enable or disable it. Access policies on containers and queues layer on top of firewall rules, and candidates often miss that the two controls operate independently. Defender for Storage provides anomaly detection across blob, file, and queue services. The exam focuses on what Defender for Storage detects (unusual data exfiltration, access from a Tor exit node, malware upload) rather than how to deploy it, though enabling and configuring the plan is also testable. Distinguishing Defender for Storage from the storage firewall is important: one is a detection control and the other is a prevention control, and the exam will describe a scenario where one is clearly more appropriate than the other.

– Database security and auditing

Azure SQL security configuration is tested at the platform level, which means authentication mode (Azure AD versus SQL authentication), transparent data encryption, and Always Encrypted are all in scope. The exam tends to reward candidates who can identify the authentication setting that eliminates a specific credential risk rather than those who can describe encryption algorithms. Database auditing for Azure SQL Database and Azure SQL Managed Instance involves configuring where audit logs go (Log Analytics, Storage, Event Hub) and understanding the difference in auditing scope between the two services. Managed Instance has additional considerations around server-level auditing that Database does not. Defender for Databases extends threat detection across Azure SQL, Cosmos DB, and open-source database services. The exam tests whether you can match the correct Defender plan to the correct database service and identify what category of threat each plan detects. Candidates lose marks by applying a SQL-specific control to a Cosmos DB scenario or vice versa.

– Network security controls and segmentation

Network security groups and application security groups are foundational controls, but the exam tests them at the rule-evaluation level. NSG rules have priority numbers, and the exam will describe a traffic flow and ask you to determine whether it is permitted or denied based on a set of rules. Application security groups let you group VMs logically and reference those groups in NSG rules, which matters when you need to segment traffic without managing individual IP addresses. Azure Virtual Network Manager introduces centralized network policy at scale, and the exam covers its security configurations for virtual network groups and connectivity policies. Azure Firewall sits above NSGs in the traffic path and operates at a higher layer: the exam distinguishes between Azure Firewall Standard and Premium capabilities, particularly around IDPS and TLS inspection. VPN connection security, including IKE policy and authentication options, is in scope. Microsoft Entra Private Access and Azure Private Link both restrict access to resources without exposing them to the public internet, but through different mechanisms. Private endpoints attach to specific PaaS resources; Private Link services expose your own services. Azure Network Watcher diagnostics, especially IP flow verify and NSG flow logs, let you evaluate effective security rules and are tested as a diagnostic skill.

How Secure storage, databases, and networking is tested

Items in this topic frequently describe a configuration state and ask you to identify what is wrong or what additional control is needed. The exam rewards candidates who can read a described rule set or access policy and reason about its effect, not just name the service that provides a given feature. NSG items are particularly likely to involve rule conflict or priority ordering: the trap is selecting a rule change that fixes one flow but breaks another. Storage items often combine a network restriction with an access method question, and candidates who focus only on one dimension miss the fuller picture the scenario is describing. Database items reward precision about which Defender plan covers which service. Networking items that involve Private Link versus private endpoints reward understanding the directionality of each: which side initiates, which side is exposed. Candidates lose marks on Virtual WAN items by applying hub-and-spoke NSG logic to a topology that does not work that way. Approach each item by identifying the layer the scenario is operating at (network, access, detection) before evaluating any option.

Compute security in this exam spans three distinct environments that share almost no tooling: AI workloads, virtual machines and hybrid servers, and application platform services including containers and serverless. The breadth is intentional. Modern workloads run across all three, and the exam tests whether you can select the right control for the right environment rather than apply a single mental model everywhere. AI security is the newest addition and carries sub-topics that do not appear in any older Microsoft security exam.

– AI workload security and Copilot risk

AI security sub-topics are concentrated here and reflect Microsoft's current product surface. The exam tests whether you can identify overexposure of data in SharePoint as a risk vector for Copilot, because Copilot respects SharePoint permissions and over-shared content becomes retrievable. Microsoft Purview DSPM surfaces those risks at the data layer. Real-time protection for Copilot Studio agents and conditional access for Entra Agent ID are both configuration tasks the exam tests at a practical level: what you enable and where. Blast radius analysis for Entra Agent ID through Defender XDR is a diagnostic skill: the exam asks you to interpret what an agent can reach, not just that blast radius analysis exists. AI Gateway in Azure API Management for Microsoft Foundry and guardrails in Foundry agent security are deployment-level controls. Defender for AI Service in Cloud Workload Protection adds detection capability. The Data and AI security dashboard in Defender for Cloud is the monitoring surface that ties these together. Managing agents through the Microsoft 365 admin center is an administrative control that the exam includes alongside the technical ones.

– Virtual machine and hybrid server security

VM security in this topic goes well below the OS level. Disk encryption covers both Azure Disk Encryption (using Key Vault) and EncryptionAtHost, and the exam tests which applies in a given scenario. Secure boot, vTPM, integrity monitoring, and security type (Trusted Launch versus Confidential VM) are hardware-level controls that candidates often overlook. The exam does test them, and the distinguishing factor is usually the threat they mitigate rather than the configuration steps. Azure Bastion eliminates public RDP and SSH exposure: the exam tests planning and implementation, including SKU differences. Just-in-time VM access reduces the attack surface by opening ports only on demand, and the exam tests enabling and enforcing JIT, not just its existence. Azure Arc extends Defender for Servers and Azure Machine Configuration to non-Azure servers, including on-premises and other cloud providers. Onboarding to Defender for Servers covers hybrid and multicloud scenarios. Defender for Servers settings include vulnerability scanning integration and EDR configuration, both of which are tested at the configuration level. Agentless scanning for VMs is a specific capability that does not require a deployed agent and is increasingly prominent in the exam.

– Container and Kubernetes security

Container security spans four services: AKS, Container Registry, Container Instances, and Container Apps. Each has a distinct security surface, and the exam does not treat them interchangeably. For AKS, the exam focuses on network policy, pod security, RBAC within the cluster, and integration with Entra ID for cluster authentication. Container Registry security centers on image scanning and access control: who can push, who can pull, and whether images are checked for vulnerabilities before deployment. Container Instances and Container Apps share some security controls but have different network integration options, and the exam tests which controls are available in each. Defender for Containers provides runtime threat detection and misconfiguration identification across these services. The exam rewards candidates who can distinguish a misconfiguration finding (a posture issue) from a runtime alert (an active threat), because the response to each is different. Candidates who apply AKS-specific controls to a Container Instances scenario, or vice versa, consistently lose marks on this group of sub-topics.

– Serverless and API security

Azure Functions, Logic Apps, and App Service each have security controls that overlap in some areas and diverge in others. For Functions, the exam focuses on authentication (Easy Auth, managed identity) and network access restrictions (VNet integration, private endpoints). Logic Apps security covers both the consumption and standard tiers, which have different network isolation capabilities. App Service security includes authentication configuration, access restrictions, and TLS settings. The exam tends to describe a specific exposure and ask which control removes it, so knowing the effect of each setting matters more than knowing the configuration path. Azure Web Application Firewall protects HTTP-layer traffic for App Service and other services: the exam tests WAF mode (detection versus prevention), managed rule sets, and custom rules. API Management back-end protection policies control what reaches APIs: the exam tests specific policy types such as rate limiting, IP filtering, and JWT validation. Candidates who know that WAF and API Management policies operate at different layers in the request path are better positioned to pick the right control for a described scenario.

How Secure compute is tested

This is the largest topic by sub-topic count, and the exam reflects that by testing across all three compute environments within a single sitting. Items on AI security reward candidates who understand the data exposure angle: the question is usually about what an AI workload can access, not about the AI model itself. VM items frequently combine a hardware-level control (secure boot, vTPM) with a Defender for Servers configuration, and candidates lose marks by treating these as independent when the scenario links them. Container items reward the ability to match a control to a specific service: a control available in AKS is not automatically available in Container Instances, and the exam exploits that gap. Serverless items reward knowing the difference between an authentication control and a network access control, because the scenario will make only one of them applicable. API Management items reward knowing which policy type addresses which category of threat. The overall trap in this topic is overgeneralising: a control that is correct for one compute type is often wrong for another, and the exam is designed to catch candidates who do not make that distinction.

Where the previous topics focused on configuring controls, this one focuses on operating them at scale and detecting what slips through. Defender for Cloud, Microsoft Sentinel, and Security Copilot are the three platforms in scope, and each demands a different mindset: Defender for Cloud is about posture and compliance measurement, Sentinel is about event collection and automated response, and Security Copilot is about AI-assisted investigation. Candidates who treat monitoring as a softer topic than configuration consistently underperform here.

– Defender for Cloud posture and workload protection

Defender CSPM is the posture layer: it identifies security risks, maps them to recommendations, and surfaces attack paths. The exam tests how to use CSPM findings, not just how to enable the plan. Evaluating compliance against security frameworks means reading a compliance score, identifying which controls are failing, and knowing what remediating them involves. Enabling and configuring workload protection plans requires knowing which plan covers which resource type and what each plan adds beyond the free tier. Connecting AWS and GCP environments to Defender for Cloud is a multicloud scenario the exam tests explicitly: the connector configuration and the resulting coverage are both in scope. Microsoft Defender Vulnerability Management settings for Azure VMs sit within Defender for Servers and cover how vulnerability findings are collected and surfaced. Defender External Attack Surface Management discovers internet-exposed assets and vulnerabilities that are outside your known inventory, and the exam tests it as a discovery tool rather than a remediation tool. Candidates lose marks by conflating EASM with CSPM: they address different scopes.

– Microsoft Sentinel architecture and data collection

Sentinel starts with workspace design: creating and connecting workspaces correctly affects data residency, cost, and role assignment. The exam tests workspace architecture decisions, not just the steps to create one. Role assignment in Sentinel follows Azure RBAC but has Sentinel-specific roles (Reader, Responder, Contributor) with distinct permission sets, and the exam tests which role is appropriate for a described job function. Content hub solutions package connectors, rules, and playbooks for specific data sources, and the exam treats enabling them as a practical configuration task. Microsoft data connectors for Azure resources bring diagnostic logs and activity logs into Sentinel: the exam tests connector selection and configuration, not just the concept of connectors. Syslog and CEF collection for non-Azure sources involves the Log Analytics agent or AMA, and the exam tests the collection pipeline. Windows Security event collection via data collection rules and Windows Event Forwarding is a separate collection path the exam treats distinctly from syslog. Custom log tables allow ingestion of data that does not fit a built-in schema, and the exam tests creating them as a workspace configuration task. Data retention settings in Sentinel affect both cost and compliance, and the exam tests configuring retention at the workspace and table level.

– Sentinel automation and investigation

Automation rules and playbooks are where Sentinel moves from detection to response. Automation rules trigger on incidents or alerts and can assign, suppress, or run a playbook. Playbooks are Logic Apps workflows: the exam tests the relationship between an automation rule and a playbook, and where each type of action belongs. Candidates lose marks by placing response logic in the wrong layer. Querying Microsoft Purview Audit in Defender XDR is an investigation skill: the exam tests knowing that Purview Audit provides a record of user and admin activity across Microsoft 365 services, and that querying it from Defender XDR is a supported workflow for cross-service investigations. The exam rewards candidates who can identify when Purview Audit is the right data source for an investigation scenario versus when Sentinel or Defender for Cloud is more appropriate.

– Microsoft Security Copilot configuration and use

Security Copilot is the AI-assisted investigation platform, and the exam covers its operational configuration rather than its conversational capabilities. Workspace configuration determines where Security Copilot operates and what data it can access. Permissions and roles in Security Copilot are separate from the Entra ID roles used elsewhere: the exam tests the Security Copilot-specific owner and contributor roles and what each permits. Plugins extend what Security Copilot can query: the exam tests enabling and configuring both Microsoft-native plugins and third-party ones. Microsoft agents and Security Store agents extend Security Copilot's automation capabilities, and the exam tests enabling and configuring them as distinct from plugins. The overall pattern in Security Copilot items is that the exam tests configuration decisions rather than the AI output: you are expected to know how to set up the platform so that an analyst can use it effectively, not to predict what the AI will say in response to a prompt.

How Manage and monitor security posture is tested

Items in this topic reward operational reasoning: given a described environment and a monitoring gap, select the configuration that closes it. Defender for Cloud items often describe a multicloud or hybrid scenario and ask which connector or plan to enable, and candidates lose marks by applying Azure-only logic to an AWS or GCP scenario. Sentinel items frequently test the data collection pipeline end to end: the trap is selecting a connector that collects the right data type but deposits it in the wrong table, or selecting an automation rule action that belongs in a playbook. Role assignment items in Sentinel reward knowing the permission boundary of each Sentinel-specific role: assigning a role that grants more access than the scenario requires is penalised as much as assigning one that grants too little. Security Copilot items are scenario-based and reward knowing the configuration surface rather than the AI's behaviour. Purview Audit items reward knowing its scope: it covers Microsoft 365 activity, not Azure resource activity, and the exam tests whether you can apply that distinction correctly when an investigation scenario spans both.