EarnYourCert
Open the app
Exams › SC-500 › Domain 3 of 4
SC-500 · Domain 3 of 4 · 20-25% of the exam

Secure compute

Domain 3 of SC-500 accounts for 20-25% of the exam. EarnYourCert has 96 original questions for this domain, all with explanations: 66 multiple choice, 14 yes/no and 16 completion or ordering items, like the real exam.

Practice domain 3 for free →No sign-up. Choose how many questions you want.

Domain 3 sample questions

8 questions from our 96-question bank for this domain. Try to answer before revealing the solution.

1. Which Microsoft Purview solution discovers and helps mitigate data security risks from generative AI usage, including Copilot?

  1. Microsoft Purview Compliance Manager
  2. Defender for Cloud Apps discovery only
  3. Azure Firewall Premium IDPS
  4. Data Security Posture Management (DSPM) for AI
Show answer

Correct answer: D. DSPM for AI provides visibility and recommendations.

2. What is the purpose of real-time protection for Copilot Studio agents?

  1. To monitor and block risky or unsafe agent actions as they run
  2. To train the agent's language model on user prompts
  3. To reduce the agent's response latency
  4. To archive agent conversations for eDiscovery
Show answer

Correct answer: A. Runtime protection adds a security check during execution.

3. Which Defender for Servers setting provides vulnerability scanning without installing an agent on each VM?

  1. Manual inventory scripts on each VM
  2. Deploying the Log Analytics agent
  3. Agentless scanning
  4. File integrity monitoring
Show answer

Correct answer: C. Agentless scanning uses disk snapshots.

4. Which Azure Bastion deployment prevents the need for a public IP on target VMs and exposes only the Bastion service in the VNet?

  1. A public IP address on every target VM
  2. An NSG rule that opens RDP from the internet
  3. Azure Bastion deployed in a dedicated AzureBastionSubnet
  4. A jump box VM with a public IP
Show answer

Correct answer: C. Bastion needs its own subnet.

5. Which Azure Container Apps setting lets the app use a managed identity to access Key Vault secrets?

  1. Enable anonymous access to the vault
  2. Store the secrets inside the container image
  3. Put plain-text secrets in environment variables
  4. Assign a managed identity and reference Key Vault secrets
Show answer

Correct answer: D. Managed identities avoid embedded secrets.

6. Which AKS feature secures secrets by mounting them from Key Vault into pods?

  1. Anonymous mounts
  2. Secrets Store CSI Driver with the Key Vault provider
  3. Secrets baked into the container image at build time
  4. Secrets stored as plain values in Kubernetes ConfigMaps
Show answer

Correct answer: B. The CSI driver avoids storing secrets in cluster state.

7. A public AKS API server must only accept connections from the company's office IP ranges. What should you configure?

  1. API server authorized IP ranges
  2. Pod network policies
  3. Defender for Containers runtime protection on every node
  4. Workload identity
Show answer

Correct answer: A. Authorized IP ranges restrict who can reach a public API server; a private cluster removes the public endpoint entirely.

8. App Service apps still allow FTP deployments with publishing credentials. What should you do to reduce risk?

  1. Enable autoscale
  2. Disable basic authentication for FTP and SCM
  3. Move the app to a higher App Service plan with more instances
  4. Add a custom domain
Show answer

Correct answer: B. Disabling basic auth forces deployments to use Microsoft Entra-backed methods.

Practice domain 3 for free →

Other SC-500 domains

1Manage identity, access, and governance20-25% 2Secure storage, databases, and networking25-30% 4Manage and monitor security posture20-25% SC-500: full practice exam→