5 SC-500 Identity and Governance Questions Explained

Identity, access and governance is 20-25% of the SC-500 exam. The questions are scenarios: a short story, four plausible answers, and one that fits best. Here are five from the course’s exam Q&A video, each with the reasoning and the Part to rewatch.

A four-step method for any scenario

1. The need: what must the engineer achieve?
2. The scope: one resource, a resource group, a subscription, or the whole tenant?
3. Prevent or detect? “Prevent” points to Policy, guardrails or a firewall; “detect” points to Defender plans or Sentinel.
4. Least privilege and least cost: of what remains, choose the smallest change that meets the need.

Question 1

Developers need Contributor on one resource group only when they deploy, for a few hours, with a manager approving. What do you configure?

Answer: An eligible Contributor assignment in PIM on the resource group, with approval. PIM makes the role eligible, not active: activated for hours, with approval and MFA, scoped to the resource group, not the subscription. Rewatch: Part 1.

Question 2

Admins must sign in to the Azure portal and CLI with a passkey or Windows Hello, never a password and SMS. Which Conditional Access grant?

Answer: Require authentication strength: phishing-resistant MFA. Require MFA accepts any second factor, including SMS. Phishing-resistant strength allows only passkeys, Windows Hello and certificates. Target Azure Resource Manager. Rewatch: Part 1.

Question 3

Users keep granting unknown apps access to their mail. Every consent must go to a named reviewer. Which two settings?

Answer: Do not allow user consent, and turn on the admin consent workflow with reviewers. With user consent off, nobody grants permissions alone; admin consent requests let users ask and a reviewer decide. Rewatch: Part 1.

Question 4

An app on an Azure VM needs a Key Vault secret, and no credential may be stored anywhere. What do you use?

Answer: A managed identity with the Key Vault Secrets User role. A managed identity has no secret to store or rotate: Azure owns the credential. Secrets User is read-only. Rewatch: Part 2.

Question 5

An attacker with Owner rights must not be able to permanently destroy Key Vault keys. What do you enable?

Answer: Purge protection. Soft delete keeps deleted objects, but an admin could purge them. Purge protection blocks purging until the retention ends, for everyone, and can never be turned off. Rewatch: Part 2.

Practise the rest

The full video walks through every question in this domain. For timed practice with a score per domain, take the SC-500 mock exam, and rewatch the Parts it points you to.