EnglishDeutschFrançaisEspañolPortuguês

Microsoft · SC-500 · Associate

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) — Practice Questions and Mock Exam

The Microsoft Certified: Cloud and AI Security Engineer Associate certification (Exam SC-500 — Implementing End-to-End Security Controls for Cloud and AI Workloads) validates the ability to design, implement, and manage security controls across Azure, hybrid, and AI-enabled environments, protecting identities, data, applications, and infrastructure.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing SC-500 freeBuy SC-500 access for $29.99
50Questions per Pass-IT mock exam
120minPass-IT mock exam time limit

Official SC-500 exam: 700 out of 1000 points to pass.

Checked against Microsoft · September 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a SC-500 sample question and read the explanation with its source. Right here, with no sign-up.

Secure storage, databases, and networking1 / 5

In Transparent Data Encryption (TDE) with a customer-managed key for Azure SQL, what does the customer-managed key (the TDE protector) actually encrypt?

AlexFull explanation from Alex

TDE uses a two-tier key hierarchy for encryption at rest. The DEK performs the symmetric encryption of database files, and the TDE protector encrypts the DEK. In service-managed TDE, Microsoft controls the protector; in customer-managed (BYOK) TDE, the customer controls the protector in Key Vault or Managed HSM, enabling separation of duties and the ability to revoke access to render the database inaccessible. Switching from service-managed to customer-managed only re-encrypts the DEK, so there is no downtime or re-encryption of the database files.

Sourcelearn.microsoft.com

How to prepare for SC-500 with Pass-IT.

Currently 397 practice questions for SC-500, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Conversation preview · SC-500

TDE key hierarchy

  1. You

    Does my customer-managed key encrypt every database page directly?

  2. Alex · AI tutor

    No. The TDE protector encrypts the database encryption key, or DEK.

    Read the Microsoft documentation ↗
  3. You

    Which key encrypts the database data?

  4. Alex · AI tutor

    The DEK performs that job. The customer-managed protector protects the DEK.

    Read the Microsoft documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

SC-500 · Question excerpt

TDE key hierarchy

View the full question

In Transparent Data Encryption (TDE) with a customer-managed key for Azure SQL, what does the customer-managed key (the TDE protector) actually encrypt?

Understand the correct answer.

The database encryption key (DEK)

The TDE protector encrypts the database encryption key rather than directly encrypting database pages.

Read the Microsoft documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your SC-500 mock exam

Questions
50
Minutes
120

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for SC-500.

Exam topics, relevant practice and sources you can check.

Identity, secrets and governance20–25% of the exam94 QuestionsPass-IT questions

You secure resource access and enforce controls across Azure and Microsoft Entra.

  • Configure privileged access, Conditional Access and authentication methods in Entra, and manage application identities, OAuth consent and managed identities.
  • Deploy Key Vault, configure access and firewall settings, manage keys, secrets and certificates, scan for exposed secrets and enable Defender for Key Vault.
  • Enforce security and compliance with Azure Policy, Defender for Cloud standards, resource locks, backup protection and infrastructure as code, and assess compliance results.
  • Manage built-in and custom Azure and Entra roles, evaluate excessive access and reduce overprivileged Azure role assignments.
Official Microsoft objectives
Storage, database and network protection25–30% of the exam113 QuestionsPass-IT questions

You apply data-service protections and control the network paths used to reach resources.

  • Configure storage-account security, firewall rules and access policies, and set up Defender for Storage threat protection.
  • Apply platform security and auditing to Azure SQL databases and managed instances, and configure Defender protection across Azure database services.
  • Configure network and application security groups, Virtual Network Manager access policies, Virtual WAN and VPN security, and Microsoft Entra Private Access.
  • Secure service access with private endpoints and Private Link, configure Azure Firewall and use Network Watcher to evaluate effective security rules.
Official Microsoft objectives
AI, server and application security20–25% of the exam98 QuestionsPass-IT questions

You protect AI agents, virtual machines and the platforms that run applications.

  • Find overshared SharePoint data and AI risks with Purview, protect Copilot Studio agents in real time, and control Entra Agent ID access while analyzing the potential reach of related risks.
  • Deploy AI Gateway for Foundry in API Management, configure Foundry guardrails and Defender for AI protection, monitor AI security and manage agents in Microsoft 365.
  • Secure virtual machines with disk encryption, Bastion, just-in-time access and trusted boot settings, and enforce server configurations across Azure and hybrid systems with Azure Arc and Machine Configuration.
  • Onboard cloud, hybrid and multicloud servers to Defender for Servers and configure vulnerability scanning, endpoint detection and response and agentless scanning.
  • Detect container misconfigurations and runtime risks with Defender for Containers, and configure security for Kubernetes, container registries, Container Instances and Container Apps.
  • Configure application security for Functions, Logic Apps and App Service, including authentication and network access, and protect web traffic and backend APIs with Web Application Firewall and API Management.
Official Microsoft objectives
Posture monitoring and security tooling20–25% of the exam92 QuestionsPass-IT questions

You assess exposure, collect security events and configure tools that support investigations.

  • Assess risks and compliance with Defender for Cloud, connect hybrid and multicloud environments, enable workload protection and vulnerability management, and discover exposed assets with External Attack Surface Management.
  • Set up Sentinel workspaces, roles and Content hub solutions, connect Azure and Windows event sources plus Syslog and Common Event Format, and create custom log tables.
  • Implement Sentinel automation rules, playbooks and data retention, and query Purview Audit in Defender XDR.
  • Configure Security Copilot workspaces, roles and permissions, enable plugins, and set up Microsoft and Security Store agents.
Official Microsoft objectives
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.
True / False
Decide whether statements are true or false.
Drag & Drop
Match items to the appropriate targets.
Ordering
Put steps in the correct order.
Dropdown
Choose the appropriate entry from a dropdown list.

These are Pass-IT practice formats. Check the Microsoft certification page for the official exam information.

The ranges describe the weighting of exam topics. See Official Microsoft objectives for the current exam objectives.

Frequently asked questions

Your preparation

How much study time should I plan for SC-500?

For planning, Pass-IT estimates roughly 35–90 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from Microsoft or a promise that you will be exam-ready within that time.

Do you need AZ-500 or SC-300 before SC-500?

No. As of 30 September 2026, Microsoft listed no prerequisite. AZ-500 retired on 31 August 2026; Microsoft named SC-500, Microsoft Certified: Cloud and AI Security Engineer Associate, as its recommended new certification, so AZ-500 is no longer an available step towards it. Our catalog’s study budget at that date was around 60 hours, higher than for the other Microsoft associate exams in our catalog. On 30 September 2026, Microsoft’s SC-500 page listed the assessed areas as Manage identity, access, and governance; Secure storage, databases, and networking; Secure compute; and Manage and monitor security posture.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with Microsoft for the languages available for the official exam.

How long does my SC-500 access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the SC-500 exam

Where can I take the SC-500 exam?

Pearson VUE online proctored or at an authorized testing center.

How long is the Implementing End-to-End Security Controls for Cloud and AI Workloads exam?

The SC-500 exam has 50 questions and a 120-minute time limit.

How often do you have to renew SC-500?

Once a year. Renewal is a free unproctored assessment on Microsoft Learn taken during the six months before expiry, not a repeat of the proctored exam. Passing it extends the certification by another year.

What happens if you fail SC-500?

A second attempt is possible after 24 hours, with 14 days between later attempts and a limit of five in any 12-month period. The exam is new, so preparation aimed at AZ-500 objectives will leave gaps.

Your preparation for SC-500

$29.99one-time

12 months of access for SC-500 · No automatic renewal

Buy SC-500 access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related certifications

Administering Information Security in Microsoft 365Administering Microsoft Azure SQL SolutionsAdministering Windows ServerCollaboration Communications Systems EngineerAll Microsoft certifications →