Free SC-500 practice questions

Privileged Identity Management turns permanent role assignments into eligible ones that users activate just in time.

The requirement is no standing privilege plus a time-limited, recorded elevation. That is exactly what an eligible PIM assignment provides: the user holds nothing until they activate, activation expires, and each activation is audited. A time-bound active assignment is the tempting near-twin, but it is still active for its whole lifetime. MFA and access reviews are useful controls that leave the permanent assignment in place.

1. Spot the deciding words: no standing privilege, on demand, time-limited, audited.
2. Recall that only an eligible assignment grants nothing until it is activated.
3. Rule out controls that leave an active assignment in place, however well protected or reviewed.

Exam tip: No standing privilege means eligible assignments in PIM, activated just in time.

Secure transfer required forces encryption in transit for REST (HTTPS only) and SMB (encrypted sessions only).

The two findings are both about data in transit: an HTTP upload and an SMB mapping without encryption. Secure transfer required is the account setting that refuses exactly those requests. Infrastructure encryption and customer-managed keys are encryption-at-rest controls, and the minimum TLS version only constrains connections that are already using TLS, so neither stops plain HTTP.

1. Classify the problem: traffic is unencrypted in transit, not at rest.
2. Recall which setting rejects HTTP and unencrypted SMB.
3. Discard the at-rest options (infrastructure encryption, customer-managed keys).
4. Note that a TLS floor doesn't apply to requests that never use TLS.

Exam tip: In transit: Secure transfer required. At rest: Microsoft-managed keys, CMK, infrastructure encryption.

SharePoint data access governance reports come in two kinds: snapshot reports (current state) and activity reports (the last 28 days).

The requirement is a baseline of existing exposure, including old grants. The site permissions snapshot report analyses the permission structure of every SharePoint and OneDrive site and highlights sites with broad access such as 'Everyone except external users'. The EEEU and sharing-links reports are activity reports that only look back 28 days, so they catch new oversharing but not the backlog. The sensitivity-label report addresses a different question: where labelled files live.

1. Decide whether you need current state or recent activity.
2. Old grants mean current state, so a snapshot report is required.
3. Of the snapshot reports, only the site permissions report shows how broadly sites are shared.
4. Use activity reports afterwards to monitor new oversharing.

Exam tip: Baseline exposure: snapshot (site permissions) report. Recent oversharing: activity reports, which look back only 28 days.

Foundational CSPM is free and gives recommendations, the secure score and the Microsoft cloud security benchmark. The paid Defender CSPM plan adds contextual risk tools such as attack path analysis, cloud security explorer and risk prioritization.

The requirement is to see how an internet attacker could move from an exposed VM to sensitive data: that is an attack path. Attack path analysis is listed only under Defender CSPM. Workload plans such as Defender for Storage, Defender for Servers or Defender for Resource Manager detect threats on their own resource types but don't build the cross-resource graph that attack paths come from.

1. Recognise the need: a chain from an internet entry point to a sensitive target.
2. That chain is an attack path.
3. Check which plan includes attack path analysis: Defender CSPM, not Foundational CSPM.
4. Workload protection plans protect single resource types and don't model paths.

Exam tip: Attack paths, cloud security explorer and risk prioritization all need the paid Defender CSPM plan.

PIM role settings: activation maximum duration vs assignment duration.

PIM has two separate clocks. The activation maximum duration (1 to 24 hours) limits each activation; the eligible assignment expiration limits how long a user stays eligible at all. The auditors' problem is long activations, so the activation maximum duration is the setting to lower. Changing eligibility expiration would remove eligibility, which the stem forbids.

1. Separate the two durations in PIM: per activation and per assignment.
2. Match the symptom (activations last too long) to the per-activation setting.
3. Discard session and review controls, which do not end an active role.

Exam tip: Activation maximum duration caps each elevation; assignment duration caps eligibility.