Microsoft Microsoft Certified: Cloud and AI Security Engineer Associate SC-500 Exam Dumps: Updated Questions & Answers (November 2026)

Encryption type

ExpressRoute circuits

Layer 2 encryption

ER3 and ER4 only

Layer 3 encryption

ER1, ER2, ER3, and ER4

For Layer 2 encryption, Azure ExpressRoute uses MACsec (Media Access Control Security). Microsoft states that MACsec is available for ExpressRoute Direct connections because customers have dedicated physical ports connecting their edge routers directly to Microsoft Enterprise Edge routers. Therefore, both ER3 (ExpressRoute Direct) and ER4 (ExpressRoute Metro Direct) can use MACsec. Provider-based ExpressRoute circuits such as ER1 and ER2 do not expose dedicated ExpressRoute Direct ports to the customer and therefore do not support this native Layer 2 MACsec capability. Microsoft Learn

For Layer 3 encryption, ExpressRoute can use IPsec over ExpressRoute private peering. Unlike MACsec, IPsec is an end-to-end network-layer encryption mechanism and is not dependent on ExpressRoute Direct physical ports. Microsoft states that IPsec over ExpressRoute works with any ExpressRoute circuit, allowing encrypted connectivity between the on-premises network and Azure over private peering.

Add a custom WAF rule. The planned change requires WAF1 to implement rate limiting based on the geographic location of incoming requests. Azure Web Application Firewall supports this combination directly through custom rate-limit rules.

Microsoft documents that Application Gateway WAF rate-limit rules can group requests by GeoLocation, where requests are categorized based on the geographic location derived from the client IP address. The rule can then apply the configured rate threshold independently to traffic originating from each geographic location. Microsoft Learn Azure WAF custom rules also support the GeoMatch operator, which evaluates requests according to their country or region of origin. Microsoft Learn

This makes a single custom rule the most direct and administratively efficient implementation.

The Azure-managed Default Rule Set (DRS) provides predefined protections against common web application attacks, such as injection and protocol attacks; it is not where custom geographic rate limits are defined. Bot Manager 1.1 identifies and handles automated bot traffic but is not the appropriate mechanism for general location-based rate limiting. Azure Policy can enforce configuration standards across resources but does not itself process web requests or impose per-location request thresholds.

Therefore, configure a custom rate-limit rule with geographic matching/grouping.

===============

The first step is to enable a system-assigned managed identity on VM1. The scenario requires VM1 to read data from storage1 and also specifies that when VM1 is deleted, the permissions associated with VM1 must effectively cease automatically.

A system-assigned managed identity has a one-to-one lifecycle relationship with the Azure resource to which it belongs. Microsoft explicitly states that when the associated resource is deleted, its system-assigned managed identity is automatically deleted from Microsoft Entra ID. In contrast, a user-assigned identity such as ID1 exists independently and remains after the VM is deleted. Microsoft Learn

After enabling the identity, the appropriate storage data-plane role—such as Storage Blob Data Reader when VM1 requires read access to blobs—can be granted to VM1 ' s managed identity at the required scope. Microsoft documents this exact pattern for a Windows VM accessing Azure Storage: enable its managed identity and assign Storage Blob Data Reader to that identity. Microsoft Learn

Federated credentials are unnecessary for a VM ' s native managed identity. Assigning ID1 would violate the lifecycle requirement because ID1 is user-assigned and survives VM1 deletion. A role assignment cannot be created for VM1 ' s system identity until that identity exists.

Therefore, first enable VM1 ' s system-assigned managed identity.

Choose Admin1 because the planned Defender for Cloud change is to enable the NIST SP 800-53 Rev. 5 regulatory compliance standard for Sub1. Defender for Cloud implements regulatory compliance standards through Azure Policy initiatives, and assigning a new standard requires permissions to create or manage policy assignments.

Microsoft states that assigning a regulatory compliance standard requires Owner or Policy Contributor permissions at the relevant scope. Microsoft Learn Admin1 has the Resource Policy Contributor Azure role on Sub1, which provides the policy-management permissions required to assign policy initiatives and therefore supports enabling the NIST standard without granting broader resource-management permissions.

Admin2 has User Access Administrator, which manages Azure RBAC assignments but does not provide the policy-management permissions required for this operation. Admin3 has Contributor, which can manage Azure resources but is restricted from performing certain Microsoft.Authorization operations, including policy assignment operations needed here. Admin4 is a Global Administrator in Microsoft Entra but has no Azure role assignment for Sub1; Microsoft Entra directory administration does not automatically provide subscription-level Defender for Cloud policy-management rights.

Because Admin1 already has the specific policy-management role required for the change, selecting Admin1 satisfies both the functional requirement and the principle of least privilege.

===============

Storage2 must be configured to use an account encryption key. The planned storage account must support Azure Table storage, while the technical requirement specifies that all storage data must be encrypted using Fabrikam-managed keys, meaning customer-managed keys (CMKs).

Azure Storage treats Table and Queue encryption differently from Blob Storage and Azure Files. Microsoft states that to encrypt Table Storage or Queue Storage with a customer-managed key, the storage account must be configured at creation time to use an encryption key scoped to the account rather than the default service-scoped key. After creation, this setting cannot be changed. Microsoft Learn

An encryption scope does not solve this requirement because encryption scopes apply to Blob Storage containers and individual blobs, not Azure Table data. Microsoft Learn

An Azure RBAC assignment may later be required so that the storage account ' s managed identity can access the customer-managed key in Key Vault, but it does not itself configure Table Storage to support account-level CMK encryption. Purge protection applies to Azure Key Vault rather than storage2.

Therefore, when storage2 is created, configure Table Storage to use the account encryption key.

===============

To register App28681041 to Azure AD and generate a password for it, you can follow these steps:

In the Azure portal, search for and select Azure Active Directory.

In the left pane, select App registrations.

Select New registration.

In the Register an application pane, enter the following information:

Name: App28681041

Supported account types: Select the appropriate account types for your scenario.

Redirect URI: Leave this field blank.

Select Register.

In the App registrations pane, select the newly created App28681041 application.

In the left pane, select Certificates & secrets.

Select New client secret.

In the Add a client secret pane, enter the following information:

Description: Enter a description for the client secret.

Expires: Select an appropriate expiration date for the client secret.

Select Add.

In the Certificates & secrets pane, copy the value of the newly created client secret.

You can find more information on this topic in the following Microsoft documentation: Quickstart: Register an application with the Microsoft identity platform.

The technical requirement states that all outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits. To accomplish this, the Function App hosting plan must support outbound virtual network integration, because the application must send outbound traffic into an Azure virtual network from which routes learned through or directed toward the ExpressRoute gateway can reach the on-premises environment.

Fa1, which uses the Flex Consumption plan, supports virtual network integration. Microsoft documents that Flex Consumption provides outbound virtual network connectivity and can therefore reach resources accessible through the integrated virtual network. Microsoft Learn

Fa3, which uses a Dedicated App Service plan, also supports outbound virtual network integration. Microsoft further documents that VNet-integrated Functions can have outbound traffic affected by BGP routes learned from an ExpressRoute gateway, and route tables can direct traffic through that gateway. Microsoft Learn

Fa2, however, uses the legacy Consumption plan, which does not support outbound virtual network integration. Consequently, it cannot meet the requirement to route its outbound on-premises traffic through ExpressRoute using this architecture. Microsoft Learn

Therefore, only Fa1 and Fa3 support the required networking configuration.

For AKS1, assign the AcrPull role on Registry1. AcrPull provides the permissions required to download container images from an Azure Container Registry without granting permissions to push, modify, or delete images. Microsoft documents that when AKS is integrated with an Azure Container Registry, the appropriate pull-only role is assigned to the AKS identity used for image pulls. This satisfies the explicit requirement that AKS1 must only be able to pull images and follows least privilege. Microsoft Learn

For ID1, assign AcrPush. Microsoft defines AcrPush as the built-in Azure RBAC role for identities that require both push and pull permissions on a non-ABAC-enabled Azure Container Registry. It therefore allows ID1 to upload container images and retrieve existing images from Registry1 without granting broad resource-management capabilities such as Contributor or Owner. Microsoft Learn

Contributor and Owner would grant substantially more Azure management permissions than required. Reader does not provide container image pull/push data-plane permissions.

Requirement

Selection

Upload images

User1 and User4 only

Download images

User1, User2, and User4

Comprehensive and Detailed 150 to 250 words of Explanation From [Cloud and AI Security Engineer/Course Guide/topics]:

User1 can both upload and download images because the AcrPush role includes permissions to push/write and pull/read artifacts in Azure Container Registry. Microsoft defines AcrPush as granting both push and pull access.

User2 can download images only because AcrPull grants read/pull access but no push permission.

User3 cannot upload or download normal container images based solely on AcrImageSigner. That role is intended for Docker Content Trust signing metadata. Microsoft states that AcrImageSigner grants signing permissions and that actual image push permission requires AcrPush or an equivalent role in addition.

User4 can upload and download because the generic Contributor role grants broad Azure Resource Manager actions, which in the legacy RBAC Registry Permissions model include the registry push and pull operations used by AcrPush/AcrPull. This question clearly uses those legacy ACR roles; if the registry were explicitly configured for the newer ABAC repository-permissions mode, Contributor and legacy AcrPush/AcrPull would behave differently.

Statement

Answer

SQL1 will have TDE enabled automatically.

No

The deployment of SQL2 will fail.

Yes

SQL3 will be deployed and marked as noncompliant.

No

SQL1 = No. SQL1 already exists in RG3 when Policy2 with the DeployIfNotExists effect is assigned. During normal policy evaluation, an existing resource that doesn ' t satisfy a DeployIfNotExists policy is marked noncompliant, but Azure Policy doesn ' t automatically alter that existing resource. Microsoft states that existing noncompliant resources require a remediation task to apply the deployment. Microsoft Learn

SQL2 deployment fails = Yes. RG2 is subject to both Policy1 and Policy2. SQL2 is explicitly being deployed with TDE disabled, so it violates Policy1 ' s Deny requirement. Microsoft documents that Deny is evaluated during resource creation/update before DeployIfNotExists runs after a successful resource-provider operation. Consequently, Policy1 blocks SQL2 before Policy2 can remediate it. Microsoft Learn

SQL3 deployed and marked noncompliant = No. RG1 has Policy1 (Deny) and Policy3 (Audit). Although the Audit policy would normally report a TDE-disabled database as noncompliant, the Deny policy prevents SQL3 from being created in the first place. Therefore, SQL3 isn ' t successfully deployed and merely marked noncompliant.