SC-500 is Microsoft's new exam for the Cloud and AI Security Engineer Associate certification - it replaces the retired AZ-500 exam - and it adds a whole area that AZ-500 never had: securing AI workloads, Copilot and agents. If you are preparing for it, you need to know which of its four skill areas you already own and which still need work.

You get four tests with 50 questions each - 200 in total, written from Microsoft's official SC-500 skills outline (study guide read on 8 October 2026). Every question is tied to one objective, so when you get one wrong you know exactly what to revise.

What makes the explanations useful

Each answer tells you why the right option is right and why each wrong option is wrong. The wrong options are where most of the learning is: they are real features, commands and settings that are easy to pick by mistake.

How the tests are built

• Test 1 - Identity, access and governance: Privileged Identity Management, Conditional Access, MFA and passwordless, app registrations and enterprise apps, consent settings, managed identities, Azure Key Vault (access, firewall, keys, secrets, certificates, Defender for Key Vault), Azure Policy, regulatory compliance in Defender for Cloud, resource locks, Azure RBAC and custom roles, Azure Backup security and infrastructure as code.
• Test 2 - Storage, databases and networking: storage account security and firewalls, SAS and access policies, Defender for Storage, Azure SQL platform security and auditing, Defender for Databases, NSGs and ASGs, Azure Virtual Network Manager, Virtual WAN, VPN, Microsoft Entra Private Access, private endpoints, Private Link, Azure Firewall and Network Watcher.
• Test 3 - Secure compute and AI workloads: SharePoint oversharing, Purview DSPM for AI, Copilot Studio agent protection, Entra Agent ID, AI gateway in API Management, Defender for AI services, Foundry guardrails, disk encryption, Bastion, just-in-time VM access, Azure Arc, Defender for Servers, Trusted Launch, Machine Configuration, Defender for Containers, AKS, ACR, Container Apps, Functions, Logic Apps, App Service, WAF and API Management.
• Test 4 - Security posture, Sentinel and Security Copilot: Defender CSPM, compliance frameworks, workload protection plans, AWS and GCP connectors, Defender Vulnerability Management, Defender EASM, Microsoft Sentinel workspaces, roles, content hub, data connectors, syslog/CEF and Windows event collection, custom tables, automation rules and playbooks, retention, Purview Audit in Defender XDR, and Microsoft Security Copilot workspaces, roles, plugins and agents.

Questions use single-answer and "choose two" formats; "choose two" is always stated in the question. Suggested time: 100 minutes each.

Versions: Microsoft Entra ID, Azure, Microsoft Defender for Cloud, Microsoft Sentinel, Microsoft Purview, Microsoft Foundry and Security Copilot as they stand in October 2026. The answers were checked against official documentation in October 2026.

Please note: these are original questions written by an instructor. They are not exam questions and do not come from the exam. This course is not affiliated with or endorsed by Microsoft.