Free
- Untimed practice across all four domains
- Every question explained, with its domain and subskill named
Microsoft · SC-500 · Cloud and AI Security Engineer Associate
It's called Cloud and AI Security. The AI is one section inside one of four domains.
Microsoft weights SC-500 across identity and governance, storage and networking, compute, and security posture. The AI content — Copilot risk, Entra Agent ID, Defender for AI Service, Foundry guardrails — sits inside the compute domain alongside VMs and containers. It's new to everyone and worth learning properly. It is not most of the paper, and studying as though it were is the fastest way to fail this exam.
- Questions weighted to the official domain split, so a mock matches the real mix
- Every item tagged to the domain and subskill it tests
- Readiness shown against 700, not as an invented percentage
Free practice across all four domains. No card required.
SC-500Secure compute — Implement security for AIHard
An organisation has deployed several Copilot Studio agents that authenticate using Microsoft Entra Agent ID. The security team wants to restrict the conditions under which those agents can obtain a token, and separately wants to understand what an individual agent could reach if its identity were compromised.
Which two actions should you take? Select two.
Two choices only. Your earliest pick was dropped.
0 of 2 selected
An original item written against the skills outline. Not a real exam question.
AZ-500 to SC-500
The same Azure security surface, plus identities that aren't people.
AZ-500 tested whether you could secure an Azure estate: Entra ID and privileged access, Key Vault, policy and compliance, storage and databases, networking, servers and containers, Defender for Cloud and Sentinel. SC-500 still tests all of that, and it's still most of the exam.
What's genuinely new is a security surface that didn't exist when AZ-500 was written: agents with their own identities, Copilot reaching data a user technically has access to but was never meant to find, and model traffic that needs a gateway in front of it. Those are the questions that will be unfamiliar. They are not the questions you'll fail on if your Entra and networking are weak.
| AZ-500 | SC-500 | |
|---|---|---|
| Credential | Azure Security Engineer Associate | Cloud and AI Security Engineer Associate |
| Scope | Azure infrastructure security | Azure and hybrid security, plus AI workloads |
| Identity | Users, service principals, managed identities | The same, plus Entra Agent ID |
| New ground | — | Copilot and DSPM risk, agent guardrails, AI Gateway, Defender for AI Service |
If you hold AZ-500 or have been doing this work, most of SC-500 is ground you already stand on. Budget your new study time for the AI section and for anything in Defender for Cloud and Sentinel that's moved since you last looked.
Which security exam
SC-500 is the one where you build it, not the one where you watch it.
Microsoft's security track splits by what you do, not by what you know. SC-500 is implementation — you configure the policies, the vaults, the firewalls and the agent guardrails. SC-200 is operations, working alerts and hunting in Sentinel and Defender XDR. SC-300 is identity specifically, in more depth than SC-500 goes. SC-100 is the expert-level architecture exam that assumes you've done one of the others.
| SC-500 | SC-200 | SC-300 | SC-100 | |
|---|---|---|---|---|
| Level | Associate | Associate | Associate | Expert |
| You are | Implementing controls | Responding to threats | Owning identity | Designing the strategy |
None of these is a prerequisite for SC-500. If you're the person who gets handed a subscription and told to make it safe, this is your exam.
Scoring
700 is a pass. It isn't 70%.
Microsoft reports technical exams on a scale of 1 to 1,000, and 700 or above passes. It's a scaled score, so it doesn't correspond to answering 70% of questions correctly — how many you need depends on the difficulty of the questions you're given.
No penalty for a wrong answer, so never leave one blank. Some questions are worth more than one point, and on some exams you can't return to a question once you've moved past it.
SC-500 · How Microsoft scales a score1–1,000 · 700 to pass
You answered
72%of the questions correctly
700
Your scaled score lands somewhere around670–730Could go either way
Now change nothing except which form you were given
Same answers. Harder form, higher scaled score — that's what scaling is for. It's also why nobody can tell you the percentage you need.
Positions here are illustrative. Microsoft publishes the 1–1,000 scale and the 700 pass mark, but not the conversion from raw answers — which is the point. When a number can't be known exactly, a range is the honest way to report it.
The loop
Practice, sit, review, repeat
Step 1 is free. Steps 2 to 4 need a subscription.
certs.acedify.com/sc-500
Practice · untimed
HardAn organisation has deployed several Copilot Studio agents that authenticate using Microsoft Entra Agent ID. The security team wants to restrict the conditions under which those agents can obtain a token, and separately wants to understand what an individual agent could reach if its identity were compromised.
Which two actions should you take? Select two.
Implement conditional access for Microsoft Entra Agent ID.
Enable Defender for AI Service in Cloud Workload Protection in Defender for Cloud.
Analyze blast radius for Entra Agent ID by using Defender XDR.
Configure and deploy AI Gateway in Azure API Management for Microsoft Foundry.
Conditional access for Entra Agent ID governs when an agent identity can authenticate. Blast-radius analysis in Defender XDR is how you map what that identity could reach. Defender for AI Service and AI Gateway are real controls on this exam, but they sit at a different layer. Domain: Secure compute — Implement security for AI.
Click a step to see it.
What you get back
Not a prediction. A distance from the line.
Your readiness is a range, because it's an inference from the questions you've answered rather than a result you've earned. For a certification the outcome is binary, so the only question that matters is whether the whole range sits above 700.
While it straddles the line, you're a coin flip, and we'll say so.
SC-500 · 4 mocks completed
Where you stand
Borderline
530–720
Pass mark 700
Your range crosses the pass mark. On today's evidence it's a coin flip.
Three states
Try the three states. We won't show you a percentage chance of passing — nobody can calculate one honestly without years of real outcomes to calibrate against.
We won't show you a percentage chance of passing. Nobody can calculate one honestly without years of real outcomes behind it.
Domains
What SC-500 actually covers
Microsoft publishes a weighted skills outline. Our mocks follow those weights, so a domain worth a quarter of the exam gets a quarter of the questions.
| Domain | Weight |
|---|---|
| Manage identity, access, and governance | 20–25% |
| Secure storage, databases, and networking | 25–30% |
| Secure compute | 20–25% |
| Manage and monitor security posture | 20–25% |
Weights are ranges because Microsoft publishes them as ranges.
Four domains, all between a fifth and a third. There's no small domain to skip and no single domain that carries you.
Note where the AI content lives. "Implement security for AI" is a sub-section of Secure compute, sitting alongside server and VM security and application platform services. Microsoft doesn't publish sub-section weights, so nobody can tell you the exact share — but it's a third of one domain out of four, not a domain of its own.
The heaviest single domain is storage, databases and networking, which is the least glamorous material on the paper and the most likely to be under-revised by someone who came here for the AI content.
Exam facts
Prices vary by country. Check Microsoft Learn for yours.
- Exam
- SC-500
- Full title
- Implementing End-to-End Security Controls for Cloud and AI Workloads
- Credential
- Cloud and AI Security Engineer Associate
- Pass mark
- 700 on a 1–1,000 scale
- Domains
- 4
- Assumed experience
- Azure and hybrid administration; strong Microsoft Entra ID; Microsoft 365 administration
Pricing
Practice free. Pay when you want to know where you stand.
Pro
- Timed mocks at exam length
- A scaled score against the 700 pass mark
- Domain-weighted readiness, and your range over time
- Everything on every exam, one subscription
One subscription covers the Microsoft certifications including SC-500, AWS, the Claude certifications, TOEFL, IELTS and the SAT.
The exam fee is separate and goes to Microsoft. We're prep, not registration.
Start practicing for freeFAQ
SC-500 questions
Find out which domain is keeping you under 700.
Free practice across all four domains, no card. The timed mocks and the readiness range are there when you want them.
Start practicing for freeAlso available for AI-300, AI-200, AI-103, AI-901, AZ-104 and the Claude certifications on the same subscription.