5 SC-500 VM and App Security Questions Explained

Secure compute and AI is 20-25% of the SC-500 exam. The questions are scenarios: a short story, four plausible answers, and one that fits best. Here are five from the course’s exam Q&A video, each with the reasoning and the Part to rewatch.

A four-step method for any scenario

1. The need: what must the engineer achieve?
2. The scope: one resource, a resource group, a subscription, or the whole tenant?
3. Prevent or detect? “Prevent” points to Policy, guardrails or a firewall; “detect” points to Defender plans or Sentinel.
4. Least privilege and least cost: of what remains, choose the smallest change that meets the need.

Question 1

A VM must keep its temp disk and caches encrypted, with no agent in the guest. What do you enable?

Answer: Encryption at host. It encrypts the temp disk and caches on the host itself. Azure Disk Encryption runs inside the guest and is being retired in September 2028. Rewatch: Part 6.

Question 2

Admins must reach Linux VMs over SSH from the browser, and the VMs must have no public IP. What do you deploy?

Answer: Azure Bastion. Bastion gives RDP and SSH in the browser over TLS, so VMs keep private IPs only. The Developer tier is free for testing. Rewatch: Part 6.

Question 3

Port 3389 must stay closed until an approved admin needs it, then open only for their IP for three hours. What do you use?

Answer: Just-in-time VM access in Defender for Servers Plan 2. JIT keeps a deny rule on the NSG and adds a temporary allow rule for the requester’s IP when access is approved. Rewatch: Part 6.

Question 4

On-premises Linux servers must be audited against the Azure compute security baseline. What do you do first?

Answer: Onboard them to Azure Arc, then assign the Machine Configuration policy. Arc makes each server an Azure resource; Machine Configuration then audits settings inside the guest through Azure Policy. Rewatch: Part 6.

Question 5

Only signed-in employees may open an App Service site, with no code changes. What do you turn on?

Answer: App Service Authentication (Easy Auth) with Microsoft Entra ID. Easy Auth puts Entra sign-in in front of the app at the platform layer: a redirect for websites, 401 for APIs. Rewatch: Part 7.

Practise the rest

The full video walks through every question in this domain. For timed practice with a score per domain, take the SC-500 mock exam, and rewatch the Parts it points you to.