CertificationsMicrosoft SC-500 Cloud and AI SecurityLabs
Microsoft SC-500 Cloud and AI Security hands-on labs
Defending cloud and AI workloads: least privilege, storage exposure, secret lifecycle and network rules.
34 labs you run in the browser: 11 guided, 15 assisted, 6 challenge, 2 capstone. About 5 hours of authored lab time. This set has no free taster yet; the free tier still carries the lessons and practice questions.
34
labs
11
guided
steps in order
8
goal only
challenge and capstone
0
free tasters
none in this set
What you practise
Exam facts and study plan- Cloud panel with the matching CLI line· you click34 labs
Every lab in this set
Title, scenario summary, skills and tool. The steps and the write-up stay in the app.
Take billing rights off a workspace role
ProGuided · Quick · 4 min · Cloud panel with the matching CLI line
Two analysts and one contractor share a role on the security workspace. The contractor runs queries and reads session reports. The role also carries Log Analytics Contributor…
security copilot workspacerole assignmentleast privilege
Give an agent identity read access only
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
An agent identity was given Contributor on its resource group during a pilot. The agent now answers from cached data and writes a status message to a queue…
managed identityleast privilegeblast radius
Keep a storage endpoint off the internet
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A storage endpoint group still allows HTTPS from every address, a leftover from the days before the private endpoint existed…
network security groupprivate endpointsegmentation
Keep the live site open and close the review copy
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
The marketing site serves product images from a container that answers anonymous reads by design. A second container holds artwork for an unreleased campaign and answers anonymous reads the…
anonymous accessencryption at restcontainer review
Move a function identity to write only
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A function writes a receipt file for every paid order and reads the order queue. Its identity was given Storage Blob Data Owner at the account during the pilot…
function identityleast privilegeworkload permissions
Stop the assistant installing its own plugins
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
The security assistant runs under a workspace identity that can work incidents and call its approved playbooks. It can also create new analytics rules by itself, which nobody approved…
assistant workspace rolesplugin reviewhuman approval
Take certificate issuing rights off an app role
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A line of business app reads two secrets at start up and checks a certificate chain before it calls a partner service. The role it runs as can also issue and delete certificates…
key vaultcertificate lifecycleleast privilege
Take exemption writing off a review role
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
Four auditors share a governance review role. It reads policy state, and it can also write exemptions, so anyone holding it can switch off a policy for any resource…
azure policyexemption workflowrole assignment
Take purge rights away from a vault role
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
An operations role for a secrets vault has carried Key Vault Secrets Officer since a migration. Purging a secret skips the recovery window, and the team only reads secrets to run checks…
key vaultsecret lifecycleleast privilege
Take tenant wide consent rights off a reporting app
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A usage reporting app was made Contributor on the reports resource group during a migration so it could read the exported reports. It reads blobs and lists the workspace…
app identityoauth consentleast privilege
Trim a vendor identity at contract end
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A recruitment vendor held a support identity through the hiring season. The contract ended on Friday and the handover runs for another week…
least privilegestanding accessoffboardinghelpdesk identity
Stop a recruitment role from inviting guests
ProAssisted · Quick · 4 min · Cloud panel with the matching CLI line
A recruitment coordinator holds User Access Administrator at the subscription, granted so they could set up a contractor's access during onboarding…
identity governanceguest accessleast privilege
Split the workspace role into two jobs
ProAssisted · Quick · 5 min · Cloud panel with the matching CLI line
The monitoring workspace was connected to six log sources last week and the analyst group was handed Log Analytics Contributor for the workspace and Microsoft Sentinel Contributor for…
workspace rolesseparation of dutiesdetection contentlog platform
Close a launch port and pin the partner gateway
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
A demo service on port 8080 was opened to every address for launch week and nobody closed it afterwards. Only the application subnet 10.30.7.0/24 still needs that port…
security group rulesnarrow allow rulespartner rangeattack surface
Close two assets nobody remembered owning
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
The exposure report listed two assets facing the internet that no team claimed. One is a storage container from a campaign that ended in 2023 and still answers anonymous reads…
external attack surfaceorphan assetsposture findingsanonymous access
Close two storage containers found in an audit
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
An audit found two containers in the security subscription that answer anonymous reads: one holds exported findings, the other holds network flow logs…
storage account securityanonymous accessencryption at rest
Harden the container that receives daily security exports
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
Defender for Cloud writes a posture report to a container every night under the same object name. An auditor asked for the report from a chosen date…
continuous exportstorage accessencryption at rest
Remove the standing remote desktop rule
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
A support window in March left 3389 open to every address on the build agent subnet group. Remote desktop now arrives two ways: through a session broker that opens the port for one hour…
just in time accessbastionnetwork rule
Restrict the syslog collector to its own subnet
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
A log collector accepts syslog from every address, on plain 514 and on 6514 for TLS. Only appliances in the 10.50.0.0/16 range forward logs…
syslog ingestiondata connectornetwork rule
Review two containers that answer anonymous reads
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
A storage alert pointed at two containers that answer anonymous reads. One holds damage photos and licence scans from insurance claims…
storage accessintended public accessencryption at rest
Send server logins through the bastion
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
Administrators sign in to the server fleet over the remote desktop port, which accepts connections from every address…
bastion accessmanagement portpatch identity
Take a secrets vault off the public address
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
The checkout service reads three secrets from a vault at start up, and its subnet is 10.20.0.0/16. A second rule already lets the operations subnet 10.21.0.0/16 through on 443 for the break…
key vault firewallnetwork rulesecret access
Take file sharing off a public address
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
A storage account group still allows the file sharing port from every address, a leftover from when staff worked from home without a VPN…
storage firewallnetwork security groupsegment scope
Keep the audit answer after the next export
ProAssisted · Quick · 7 min · Cloud panel with the matching CLI line
An auditor asked who read the payroll table in March. The database audit rows are exported to a container every night under the same object name…
database auditingaudit trailcontainer versioninganonymous access
Close a database port and trim the audit role
ProAssisted · Quick · 8 min · Cloud panel with the matching CLI line
The orders database answers 1433 from every address, which a contractor opened for a two-week migration last spring. The order service subnet is 10.70.1.0/24. In the same review…
azure sql firewalldatabase auditingrole scope
Close six items on a log estate before the detection review
ProAssisted · In-depth · 32 min · Cloud panel with the matching CLI line
The detection team reviews its log estate on Monday. The raw archive answers the internet, uses Microsoft-managed keys and keeps no history. The evidence store keeps no earlier object…
storage account exposureencryption at restblob versioningnetwork security group
Stop the deploy pipeline granting exemptions
ProChallenge · Quick · 6 min · Cloud panel with the matching CLI line
A failed deployment was fixed by the pipeline identity writing itself a policy exemption. The pipeline still needs to tag and log the resources it builds…
policy exemptionsrole versus policyautomation identityleast privilege
Close the cluster agent port to the world
ProChallenge · Quick · 7 min · Cloud panel with the matching CLI line
The node subnet group for a container cluster answers 10250 from every address. That port is the node agent, and it can start and inspect containers on the node it serves…
container platformnode agent portnetwork rule
Limit the container registry to its own networks
ProChallenge · Quick · 7 min · Cloud panel with the matching CLI line
The container registry answers on 443 from every address, which an assessment called out because the images include the internal build tooling…
private registrysecurity group rulesimage lifecycleplatform service
Shrink an agent knowledge base and its reader role
ProChallenge · Quick · 7 min · Cloud panel with the matching CLI line
A support agent answers questions from a container of approved articles. The container answers anonymous reads, the account uses Microsoft-managed keys…
ai workload data exposureleast privilegeblast radius
Shut a managed instance pair to the internet
ProChallenge · Quick · 8 min · Cloud panel with the matching CLI line
Two managed instances sit in a failover group, one in this subscription and one in the partner subscription. Their subnet group answers 1433 and 5022 from every address…
managed instance subnetfailover groupnetwork rule
Open a claims intake estate to a broker without leaving the doors open
ProChallenge · In-depth · 36 min · Cloud panel with the matching CLI line
An insurance claims platform is handing its intake side to an appointed broker before a security review. The evidence container answers the internet…
storage account exposureencryption at restblob versioningnetwork security group
Close discovery findings before the client retest
ProCapstone · In-depth · 37 min · Cloud panel with the matching CLI line
A litigation support firm has a client retest on Thursday. The exhibits container answers anonymous reads, uses Microsoft-managed keys and keeps no history…
storage account exposureencryption at restblob versioningnetwork security group
Close five findings on a records platform
ProCapstone · In-depth · 38 min · Cloud panel with the matching CLI line
The security board reviews the records platform on Friday. The evidence container answers the internet and uses Microsoft-managed keys…
storage account exposureencryption at restblob versioningnetwork security group
Where to go next
Every certification with labsSC-500 lab questions
There are 34 labs: 11 guided, 15 assisted, 6 challenge, 2 capstone. Together they carry about 5 hours of authored lab time, and none of them is a free taster yet.
Practise SC-500 the way the exam asks
Open a guided lab first, then work the challenge set with the hints off. Every lab links back to the lesson it tests.
Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.