5 SC-500 Storage, SQL and Network Questions Explained

Storage, databases and networking is 25-30% of the SC-500 exam. The questions are scenarios: a short story, four plausible answers, and one that fits best. Here are five from the course’s exam Q&A video, each with the reasoning and the Part to rewatch.

A four-step method for any scenario

1. The need: what must the engineer achieve?
2. The scope: one resource, a resource group, a subscription, or the whole tenant?
3. Prevent or detect? “Prevent” points to Policy, guardrails or a firewall; “detect” points to Defender plans or Sentinel.
4. Least privilege and least cost: of what remains, choose the smallest change that meets the need.

Question 1

A storage account must stop accepting the account keys entirely; apps already use Entra ID. What do you set?

Answer: Allow storage account key access: Disabled. It forces every request through Entra ID and RBAC. Rotation still leaves a key that works; enforce it with the built-in policy. Rewatch: Part 4.

Question 2

A partner needs read access to one container for 24 hours, and you must be able to cut it off early. Which SAS?

Answer: A user delegation SAS, signed with Entra ID credentials. It is signed by an Entra identity, not the account key, scoped and time-limited; revoke it early by revoking the user delegation keys. Rewatch: Part 4.

Question 3

Uploads must be scanned for malware as they arrive, and a malicious blob must raise an alert. What do you turn on?

Answer: Defender for Storage with on-upload malware scanning. Each blob is scanned on upload, the verdict is tagged, and an alert is raised. Set a monthly GB cap to control cost. Rewatch: Part 4.

Question 4

Only one app subnet and one admin IP may reach a storage account. Which setting?

Answer: Enabled from selected virtual networks and IP addresses, with a virtual network rule and an IP rule. The storage firewall allows named subnets and named public IP ranges; add a resource instance rule or the trusted services exception if needed. Rewatch: Part 4.

Question 5

Azure SQL must have no SQL logins or passwords at all. What do you configure?

Answer: Microsoft Entra-only authentication. It turns SQL authentication off on the server, so every login is an Entra identity with MFA and Conditional Access. Rewatch: Part 4.

Practise the rest

The full video walks through every question in this domain. For timed practice with a score per domain, take the SC-500 mock exam, and rewatch the Parts it points you to.