Microsoft
Free SC-500 Practice Exams & Study Guide
The Microsoft SC-500 exam is up to 60 questions in 120 minutes, and the voucher costs $165. CertCrush provides 500 syllabus-aligned practice questions and 10 performance-based questions across all 4 exam domains, each with a full explanation. Free to try, no account required.
The Microsoft Cloud and AI Security Engineer Associate (SC-500) course prepares professionals to secure cloud workloads, AI services, and hybrid environments using Microsoft Defender, Sentinel, Purview, and Entra.
Practice content last updated · Independently written and aligned to Microsoft’s published exam objectives.
10
Sample questions
120 min
Exam time limit
70%
Practice pass mark
$165
Exam voucher
About the Microsoft SC-500 Exam
The Microsoft SC-500 (Cloud and AI Security Engineer Associate) is Microsoft's newest security certification, built for a world where organisations run critical workloads across cloud platforms and increasingly rely on AI services. It validates your ability to design, implement, and manage security across Microsoft's full security stack, with a sharp focus on protecting both traditional cloud environments and emerging AI workloads. This exam sits at the intersection of cloud security and AI security, two of the fastest-growing areas in the industry. You will be tested on threat protection with Microsoft Defender XDR, security operations and detection engineering in Microsoft Sentinel, data security and governance through Microsoft Purview, and identity and access management with Microsoft Entra. Crucially, the SC-500 also covers securing AI workloads against modern risks such as prompt injection, data leakage, and model misuse, reflecting the realities security teams now face. The exam typically features 40 to 60 questions delivered in multiple formats, including multiple choice, case studies, and scenario-based questions designed to test practical judgement rather than rote memorisation. You usually have around 100 to 120 minutes to complete it, and a passing score of 700 out of 1000 is required. Earning the SC-500 proves you can secure cloud and AI environments end to end, positioning you for high-demand roles such as cloud security engineer, security operations analyst, and AI security specialist. It is an ideal next step for professionals who already hold certifications like SC-200, SC-300, or AZ-500. CertCrush helps you prepare with free SC-500 practice questions, timed practice tests and full mock exams built for the new Cloud and AI Security Engineer exam.
Exam Domains Covered
Exam Format & Details
The Microsoft SC-500 (Cloud and AI Security Engineer Associate) exam typically consists of 40 to 60 questions in a mix of formats, including multiple choice, drag-and-drop, and case study scenarios. The time limit is generally 100 to 120 minutes. The passing score is 700 on a scale of 100 to 1000. The exam is booked through Microsoft Learn and delivered via Pearson VUE, either at a test centre or via online proctoring from your home or office. The exam voucher costs $165 USD in most markets, though local pricing varies. There are no formal prerequisites, but Microsoft recommends hands-on experience with Microsoft Entra, Microsoft Sentinel, Microsoft Defender, and Microsoft Purview before sitting the exam. Results are typically available immediately after the exam.
Why Practice Questions Matter
The SC-500 leans heavily on case studies and scenario-based questions, which means you are not just recalling facts, you are deciding which Microsoft tool solves a problem and how to configure it. A question might hand you an incident in Microsoft Sentinel and ask which KQL query or analytics rule fixes it, or describe a shadow AI risk and ask how Microsoft Purview should govern it. You cannot pass SC-500 through memorisation alone. Because it spans Defender XDR, Sentinel, Purview, Entra, and AI-specific threats like prompt injection, the real challenge is knowing which tool does what under pressure. Timed practice builds the fluency to read a scenario, eliminate the wrong tools, and pick the right answer quickly. CertCrush questions are written to match the SC-500 domain weighting, so your study time targets the areas that actually appear on the exam.
Try Microsoft SC-500
Get a taste before you commit — no account needed. Then a free account unlocks 25 questions with readiness tracking, no card required.
Get full access to Microsoft SC-500
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
This course
$9.99
one-time
Monthly
$12.99
per month · all courses
Takes 30 seconds — create a free account, then straight to checkout. Already have an account? Sign in
Try 2 performance tasks free
Drag-and-drop, sequencing and configuration tasks that mirror the interactive questions on the real Microsoft SC-500 exam — marked with partial credit.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft SC-500 exam — not actual exam content.
Q1.Your organization has acquired a subsidiary that maintains its own Microsoft Entra tenant. You need to allow users from the subsidiary to access selected resources in your tenant without creating new accounts for them. What should you implement?
- A.Cross-tenant synchronization with user provisioning
- B.B2B collaboration guest invitations
- C.Administrative units with delegated admins
- D.A separate Entra ID Premium P2 tenant
Domain: Identity, Access, and Governance
Q2.You are deploying a new general purpose v2 storage account that will hold confidential financial reports. The account must be reachable only from a specific subnet in your hub VNet and from the corporate public IP range 203.0.113.0/24. Which configuration is MOST appropriate?
- A.Set Public network access to 'Enabled from all networks' and rely on Entra ID authorization
- B.Set Public network access to 'Enabled from selected virtual networks and IP addresses' and add the subnet service endpoint plus the IP range
- C.Set Public network access to 'Disabled' and create only a service endpoint on the subnet
- D.Set Public network access to 'Enabled from all networks' and add the corporate IP to the firewall allowlist
Domain: Storage, Databases, and Networking
Q3.You need to provide secure RDP and SSH access to Azure VMs without exposing public IPs. The solution must support native client connections and IP-based connections to on-prem VMs over ExpressRoute. Which Bastion SKU is required?
- A.Basic
- B.Standard
- C.Premium
- D.Developer
Domain: Securing Compute and AI Workloads
Q4.You need to suppress a recommendation for a specific set of resources because of a documented business justification, while still showing the recommendation for other resources. What should you create?
- A.A policy disablement
- B.An exemption with category 'Waiver' or 'Mitigated'
- C.A custom recommendation
- D.A governance rule
Domain: Security Posture, Sentinel, and Security Copilot
Q5.You need to ensure that newly created guest users in your tenant can only sign in with their existing identity provider and cannot enumerate other users in the directory. Which two settings should you configure? Choose the best single answer.
- A.Set guest user access restrictions to the most restrictive option and configure External collaboration settings
- B.Assign guests the Directory Readers role and enable Conditional Access
- C.Create a dynamic group of guests and apply a sign-in frequency policy
- D.Enable Entra ID Protection user risk policy for guest accounts
Domain: Identity, Access, and Governance
Q6.An organization needs to allow on premises data scientists to query an Azure SQL Managed Instance via ExpressRoute with private endpoint disabled (using the MI's built in private VNet endpoint). What DNS configuration is required on premises?
- A.Public DNS lookup of database.windows.net
- B.Conditional forwarder from on premises DNS to Azure DNS or Azure Private DNS Resolver so the MI FQDN resolves to its private VNet IP
- C.Hosts file entries on each laptop
- D.No DNS configuration needed
Domain: Storage, Databases, and Networking
Q7.You manage 200 Azure VMs and need vulnerability assessment plus file integrity monitoring without deploying any agents to the VMs themselves. Which Defender for Servers configuration is MOST appropriate?
- A.Defender for Servers Plan 1 with MDE auto-provisioning
- B.Defender for Servers Plan 2 with agentless scanning enabled
- C.Defender for Cloud free tier with Azure Update Manager
- D.Defender for Servers Plan 1 with Qualys legacy assessment
Domain: Securing Compute and AI Workloads
Q8.Your organization wants to identify multi-step attack chains from internet-exposed VMs to sensitive data stores. Which Defender for Cloud capability MUST be enabled?
- A.Foundational CSPM
- B.Defender CSPM
- C.Defender for Storage
- D.Azure Policy regulatory compliance
Domain: Security Posture, Sentinel, and Security Copilot
Q9.Your company uses Microsoft Entra Connect to synchronize on-premises Active Directory to Entra ID. You need to ensure that password hash synchronization is used as the sign-in method while still allowing seamless single sign-on. What should you do?
- A.Configure pass-through authentication and disable PHS
- B.Enable PHS and Seamless SSO in Entra Connect
- C.Federate the tenant with AD FS
- D.Enable cloud-only authentication and remove Entra Connect
Domain: Identity, Access, and Governance
Q10.You need to grant a partner read access to a single container for 24 hours without exposing the storage account key. Which SAS type provides the LEAST privilege and best auditability?
- A.Account SAS signed with the storage account key
- B.Service SAS signed with the storage account key
- C.User delegation SAS signed with an Entra ID key
- D.Shared key in a connection string
Domain: Storage, Databases, and Networking
Microsoft SC-500 guides & exam news
How to Pass the Microsoft SC-500 Exam in 2026: An 8-Week Study Plan for the New Cloud and AI Security Engineer Certification
SC-500 is the new Microsoft Cloud and AI Security Engineer Associate exam that replaces AZ-500. This 8-week study plan walks through every domain, the new AI security objectives and exactly how to pass on your first attempt.
AZ-500 vs SC-500: Which Microsoft Security Certification Should You Take in 2026?
AZ-500 retires on 31 August 2026 and SC-500 is its replacement. This guide compares the AZ-500 vs SC-500 domains, cost, format and timing so you can choose the right Microsoft security exam and not waste a study cycle.
DP-100 Is Retired: What Replaces the Azure Data Scientist Certification in 2026 (And What Happens to the One You Hold)
DP-100 retired on 1 June 2026 and Microsoft has pointed data scientists at AI-300 instead. Here is what changed, what happens to a DP-100 you already earned, and whether AI-300 is actually the right next exam for you.
Microsoft AB-731 AI Transformation Leader Explained: Domains, Cost and Is It Worth It in 2026?
Microsoft AB-731 AI Transformation Leader is the AB series credential for leaders who direct AI adoption rather than build it. Here are the exam domains, the format, the AB-730 difference, and an honest verdict on whether it is worth sitting in 2026.
Frequently Asked Questions
Does the Microsoft SC-500 course include performance-based questions?
Yes. The Microsoft SC-500 course includes 10 performance-based questions (PBQs) — hands-on tasks that mirror the interactive questions on the real exam, including drag-and-drop matching, sequencing and configuration screens. Each one is marked with partial credit, so you can see exactly which placements were wrong, and every task includes a full explanation. The first two are free to try.
What is included in the free Microsoft SC-500 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft SC-500 course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the Microsoft SC-500 course page.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft SC-500 course cover?
The course covers 4 exam domains: Identity, Access, and Governance, Storage, Databases, and Networking, Securing Compute and AI Workloads, Security Posture, Sentinel, and Security Copilot.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.