Free Cloud and AI Security Engineer Associate SC-500 practice questions

Sample question 1. A login page behind Azure Front Door receives credential-stuffing bursts from a few client IPs. The team wants any client IP that exceeds 100 requests per minute to the /login path blocked temporarily. What should be added to the WAF policy?

1. A rate limit rule on /login, grouped by client IP.
2. A geo-filter rule blocking the attackers’ countries.
3. The default managed rule set in Prevention mode.
4. Azure DDoS Network Protection on the origin virtual network.

Sample question 2. Events arriving through a data collection rule include a verbose payload column that is expensive to store and contains personal data the SOC does not need. The team wants the column removed before the data is stored. What should it use?

1. A saved function that omits the column at query time.
2. A shorter retention period on the table.
3. A weekly purge request against the workspace.
4. A DCR transformation that removes the column.

Sample question 3. A user reports being blocked when opening a line-of-business app from a hotel. There are 40 Conditional Access policies. Before anything changes, an administrator wants to see which policies would apply to that user, app, location, and device platform. Which tool should the administrator use?

1. The directory audit log filtered by the user’s name.
2. The Conditional Access What If tool.
3. The Identity Secure Score recommendations page.
4. The app’s usage and insights report.