The exam
SC-500 (Implementing End-to-End Security Controls for Cloud and AI Workloads) validates the skills of a security engineer who implements comprehensive security controls across identity, network, application, data, and compute — including securing the platforms, data, identities, and infrastructure used by AI workloads such as Microsoft Copilot and Microsoft Foundry. It replaces AZ-500 (Azure Security Engineer Associate), which retires 2026-08-31, with an expanded scope that folds in AI security and Microsoft Security Copilot.
Who it is for
Security engineers who protect organizational systems and data across cloud and hybrid environments by implementing comprehensive security controls that proactively help prevent unauthorized access and mitigate risk — spanning identity, network, application, data, and compute, plus securing AI workload platforms, data, identities, and infrastructure. Candidates work closely with architects, administrators, engineers, analysts, and developers across Azure, Microsoft 365, identity and access, information protection, security operations, DevOps, application development, database platforms, and networks. Practical experience administering Azure and hybrid environments (compute, network, storage) is expected, with strong familiarity with Microsoft Entra ID and familiarity with Microsoft 365 administration.
What it covers
Your readiness map in the app is organised the same way, so what you see here is exactly what you study against.
What Preppio gives you
Across every domain above, in 5 formats: concept, scenario, ordering, multi-select, matching. Each one explains why the right answer is right and every distractor wrong.
Per domain, whether you are ready, weak, or not started — the same domains and weights as the exam itself.
Your study partner. He tracks where you are weak and drills exactly that, instead of serving you what you already know.
Try one
Answer on the page. The explanation appears when you submit; use Next to move through the formats.
Sample 1 · Concept
You are the security administrator for Contoso, Ltd. You have a storage account named storage1 that stores encrypted data using Microsoft-managed keys. Company policy now requires that Contoso control and be able to revoke the encryption keys independently of Microsoft, with keys stored in a hardware security module the company manages. What should you configure for storage1?
Pick one, then submit.
Study links
FAQ
50 questions in 100 minutes.
70%, a scaled score of 700.
4 domains, weighted as the exam weights them: Manage identity, access, and governance (24%), Secure storage, databases, and networking (29%), Secure compute (24%) and Manage and monitor security posture (23%). Your readiness map in the app is organised by the same domains, so what you study against is what the exam tests.
Five formats: concept, scenario, ordering, multi-select and matching. The practice questions use every one of them, and the sample on this page shows one of each.
SC-500 is on the Single, Dual and All Access plans. You start on the free tier and add it from the plan picker inside the app. Three fundamentals exams (AZ-900, CLF-C02 and CDL) are always free, and the sample on this page is free to try.
Every question is generated from the exam's published objectives, then checked for accuracy, answer key and explanation before it is served. Nothing is copied from any exam, questions rotate by how often they have been seen, and they are retired when the objectives change.
