Certification guide
The Microsoft SC-500 exam earns the Microsoft Certified: Cloud and AI Security Engineer Associate credential — the associate-level security certification that replaces the retired SC-200 and folds in the AI-security work that used to live scattered across specialty exams. It validates that you can design and operate security controls across Microsoft Entra, Azure, Microsoft 365, and the AI stack (Azure OpenAI, Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot).
SC-500 replaces SC-200 as Microsoft’s associate-level security credential, expanding scope beyond SOC operations to cover the full lifecycle a modern security engineer touches: identity and governance, data-plane security for storage/databases/networking, compute security (including confidential computing and AI-workload security), and posture management with Microsoft Defender for Cloud and Microsoft Sentinel. The credential is renewed annually for free via an online assessment on Microsoft Learn.
Exam \u00b7 SC-500 Level \u00b7 Associate Format \u00b7 ~40\u201360 items Time \u00b7 100 min working Pass \u00b7 700 / 1000 Cost \u00b7 $165 USD Renewal \u00b7 Free, yearly Prereq \u00b7 None (SC-900 recommended)
Manage identity, access, and governance
Domain 1 \u00b7 20\u201325%Microsoft Entra ID identity protection, Conditional Access with authentication strengths (phishing-resistant MFA, multifactor, passwordless), Privileged Identity Management for just-in-time role activation with approval workflows, workload identities and Entra Agent ID for AI-agent identity governance, Continuous Access Evaluation, Entra ID Governance access reviews and access packages, Azure RBAC and ABAC with condition builder, Azure Policy at management-group scope with restricted exemption rights, and Microsoft Purview data governance touchpoints. The domain sets the identity foundation every other domain builds on \u2014 an admin-role misassignment tends to blow up every other control in the chain.
Secure storage, databases, and networking
Domain 2 \u00b7 25\u201330%The heaviest domain. Storage account hardening (private endpoints, disabled shared-key access, disabled anonymous access, TLS 1.2 minimum, CMK in Key Vault or Managed HSM), immutable blob storage with locked time-based retention policies, Azure Files authentication modes (AD DS, Entra Kerberos, Entra Domain Services), Azure SQL Database and Managed Instance security (Always Encrypted with secure enclaves, Defender for SQL, TDE with CMK), Cosmos DB CMK and private endpoints, Azure Firewall Premium with IDPS in Alert-and-deny mode and TLS inspection, Azure Virtual Network Manager security admin rules that supersede subnet NSGs, Azure Front Door Premium WAF with bot protection and rate limiting, Azure Application Gateway WAF, private endpoints and Private Link Service for partner-tenant access, ExpressRoute encryption (MACsec at L2 on ER Direct ports, IPsec-over-ER at L3), and Azure DNS Private Resolver for hybrid resolution.
Secure compute (including AI workloads)
Domain 3 \u00b7 20\u201325%Where SC-500 diverges most from SC-200. Microsoft Defender for Endpoint with direct-sensor onboarding, Defender for Servers Plans 1 and 2 (Plan 2 unlocks agentless machine scanning, full MDVM, and JIT VM access), Azure Bastion Premium with session recording to a Log Analytics workspace, Just-In-Time VM access replacing scheduled NSG jobs, Trusted Launch VMs with Secure Boot and vTPM measuring the boot chain, Azure Confidential Computing VMs on AMD SEV-SNP or Intel TDX for memory-encrypted TEE workloads, Azure Machine Configuration on Arc machines applying Defender for Cloud baselines, Azure Container Registry supply-chain security with content trust and signed-image admission policy, AKS ingress and egress control (internal-only environments, private endpoints for ACR, kubelet identity with AcrPull), and the AI-security stack: Microsoft Defender for AI Service for prompt-injection and credential-leak detection, Purview Data Security Posture Management (DSPM) for AI to surface oversharing before broad Copilot rollout, Purview real-time protection for Copilot Studio, Foundry content filters and safety systems with custom categories, Azure API Management LLM policies (llm-token-limit, llm-emit-token-metric) as an AI gateway, and Entra Agent ID with Conditional Access for workload identities to govern AI-agent sign-in.
Manage and monitor security posture
Domain 4 \u00b7 20\u201325%Microsoft Defender for Cloud secure score, Foundational vs. paid Defender CSPM (paid unlocks attack path analysis, agentless secret scanning, and sensitive data discovery), the regulatory compliance dashboard and adding standards like NIST SP 800-53 R5, ISO 27001, HIPAA HITRUST, PCI DSS 4.0, and NIST 800-171, Defender EASM for external attack surface discovery of forgotten public assets, MDVM findings across endpoints and servers, multicloud onboarding via the AWS connector (CloudFormation stack + STS role) and GCP connector, Microsoft Sentinel workspace design for multi-region residency with Azure Lighthouse projecting cross-workspace query rights, Sentinel roles (Responder for triage, Contributor for rule authoring, Reader for read-only), Content hub solutions bundling connectors and analytic rules, Azure Monitor Agent with data collection rules replacing the retired Log Analytics agent, Sentinel automation rules for incident-creation actions and playbooks with managed-identity authentication, Sentinel interactive vs. archive retention with Search jobs for long-tail queries, Defender XDR Advanced Hunting across the AuditLogs schema, Microsoft Security Copilot workspaces provisioned with Security Compute Units (SCUs), and Microsoft Security Store agents that run inside Copilot workspaces and consume SCU capacity.
Practice with the Certifym.net SC-500 bank at scale: 1,000 unique scenario-based items rotating through ten industry verticals (generic enterprise, healthcare with HIPAA, financial services under PCI DSS 4.0 and SOX, manufacturing/OT with ISA/IEC 62443 and the Purdue model, federal/government at FedRAMP High and DoD IL4/5 with NIST 800-53 and CMMC, retail/e-commerce with PCI and account-takeover scenarios, SaaS multi-tenant with SOC 2 Type II and Azure Lighthouse, higher education with FERPA and CUI research, energy/utilities under NERC CIP and TSA pipeline directives, and telecom with 5G Core, MEC, and CALEA). Simulator mode draws 60 random questions per attempt \u2014 the top of Microsoft’s published ~40\u201360 item count \u2014 so each sitting feels like the real exam. Aim for 75% or better on repeated draws before booking. That’s an honest raw-score equivalent that gives you headroom against the scaled-score conversion (Microsoft’s 700/1000 pass mark is roughly a 65\u201370% raw threshold), and you want to be scoring well above it consistently \u2014 not because the exam is trivial but because you want the buffer for the two or three items that hit an unfamiliar angle, not luck in the heavy ones.
Microsoft Cloud and AI Security Engineer Associate — Practice Exam
Practice bank for the Microsoft SC-500 (Cloud and AI Security Engineer Associate) exam from Certifym.net. Over 1,000 unique scenario-based items across the four official Microsoft Learn…
Subscribe to startTrademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. “Microsoft,” “Microsoft Certified,” “Azure,” “Microsoft Entra,” “Microsoft Defender,” “Microsoft Sentinel,” “Microsoft Purview,” “Microsoft 365,” “Copilot,” and related names, marks, and logos are trademarks or registered trademarks of Microsoft Corporation in the United States and/or other countries. Exam codes referenced (including SC-500, SC-900, AI-102, AI-103, AZ-104, AZ-500, and SC-100) are used solely for descriptive and study-aid purposes. All other trademarks are the property of their respective owners.
All practice questions, explanations, and study materials on Certifym.net are original works authored by Certifym Exam Services, LLC. Content is aligned to the publicly available Microsoft Learn exam skills outline for SC-500 and does not reproduce official Microsoft exam questions, question banks, or copyrighted training material. Passing our practice tests does not guarantee passing the official Microsoft SC-500 exam.