SC-500 · Domain 2 of 4

SC-500 Domain 2: Secure storage, databases, and networking

This is the heaviest SC-500 group. It covers securing data and the network it travels on: storage account security and Defender for Storage, Azure SQL security and auditing, and network controls from NSGs and private endpoints to Azure Firewall.

Exam weight
25–30%
Official functional groups
3
Estimated questions estimate
11–16
Suggested study time estimate
25–35 hrs

About 12 min read Reviewed October 2026

Overview

Securing storage, databases, and networking is the largest group on the exam. It covers three areas. Storage account security covers configuring account security, Azure Storage firewall rules, Defender for Storage threat protection, and access policies. Database security covers platform-level security in Azure SQL, auditing for Azure SQL Database and Managed Instance, and Defender for Databases. Network security covers network security groups and application security groups, Azure Virtual Network Manager, Virtual WAN security, VPN security, Microsoft Entra Private Access, private endpoints and Private Link, Azure Firewall, and evaluating effective rules with Network Watcher.

As the successor to AZ-500, SC-500 keeps this content largely intact. It is the heaviest group because data and network exposure are where most real breaches happen, and the exam tests precise distinctions such as service endpoints versus private endpoints and NSGs versus Azure Firewall.

How it's tested

Expect scenario questions that describe a data-protection or network requirement and ask which control to use, or why a proposed control is insufficient. The exam rewards knowing each control's scope and the difference between similar controls. Watch for what a control cannot do.

  • Right network control

    A traffic-filtering or isolation need is described, and you must choose NSG, ASG, private endpoint, Azure Firewall or WAF.

  • Private vs. service endpoint

    A requirement to secure access to a PaaS resource is described, and you must choose between a service endpoint and a private endpoint.

  • Storage or database protection

    A storage or SQL security need is described, and you must choose the access method, encryption or Defender plan.

Reasoning it through

A team must ensure that a storage account is reachable only over a private IP from one virtual network, with no exposure to the public internet. A service endpoint still uses the storage account's public endpoint, just restricted to the subnet. A private endpoint assigns the storage account a private IP in the virtual network and removes public exposure, which is what the requirement demands.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

2.1 Implement security for storage accountsAccount security, Storage firewall rules, Defender for Storage and access policies.
What it means
This covers configuring security for storage accounts, Azure Storage firewall rules to restrict network access, Defender for Storage threat protection, and managing access through access policies, including the choice between account keys, shared access signatures and Microsoft Entra ID authorization.
What to understand
Storage access can use account keys (full access, hard to rotate), shared access signatures (scoped, time-limited), or Microsoft Entra ID (identity-based, preferred). Storage firewall rules and private endpoints restrict which networks reach the account. Defender for Storage detects threats such as malware uploads and unusual access. Protections such as soft delete, versioning and immutable storage guard against data loss.
How it shows up
A storage access or protection need is described, and you must choose the access method, network control or Defender configuration.
Common confusion
Using account keys where a shared access signature or Entra ID would be safer. Account keys grant full access and are hard to rotate.
2.2 Implement security for databasesAzure SQL platform security, auditing and Defender for Databases.
What it means
This covers platform-level security configurations in Azure SQL, database auditing for Azure SQL Database and Managed Instance, and Defender for Databases protection across Azure database services, along with related controls such as Microsoft Entra authentication, Transparent Data Encryption, dynamic data masking and Always Encrypted.
What to understand
Transparent Data Encryption protects data at rest automatically. Always Encrypted protects sensitive columns so that even administrators cannot see plaintext. Dynamic data masking hides data in query results without changing stored data. Microsoft Entra authentication replaces SQL logins with identity-based access. Defender for Databases detects threats such as SQL injection and anomalous access.
How it shows up
A database protection need is described, and you must choose the encryption, masking, authentication or Defender option.
Common confusion
Confusing Transparent Data Encryption with Always Encrypted. TDE encrypts the whole database at rest; Always Encrypted protects specific columns from everyone, including administrators.
2.3 Implement security for Azure network servicesNSGs and ASGs, Virtual Network Manager, Virtual WAN, VPN, private endpoints, Private Link and Azure Firewall.
What it means
This covers network security groups and application security groups, network access policies with Azure Virtual Network Manager, Virtual WAN security, VPN security, Microsoft Entra Private Access, private endpoints for PaaS resources, Private Link services, Azure Firewall, and evaluating effective security rules with Azure Network Watcher.
What to understand
NSGs filter traffic by source, destination, port and protocol, and ASGs group resources for simpler NSG rules. A service endpoint restricts a PaaS resource to a subnet but keeps its public endpoint; a private endpoint gives it a private IP and removes public exposure. Azure Firewall provides centralized, stateful filtering and, in Premium, deeper inspection. Network Watcher helps diagnose which rules actually apply.
How it shows up
A network filtering or isolation requirement is described, and you must choose the control and recognize what each cannot do.
Common confusion
Confusing service endpoints with private endpoints, or assuming an NSG replaces a Web Application Firewall or Azure Firewall inspection.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Storage access methods

    Account keys, shared access signatures (SAS) and Microsoft Entra ID authorization.

    Remember
    Entra ID is preferred; account keys grant full access and are hard to rotate.
    Tested as
    Storage access questions.
    Trap
    Using account keys where SAS or Entra ID is safer.

  • Shared access signature (SAS)

    A scoped, time-limited token granting specific storage access.

    Remember
    It limits what and for how long, unlike a full account key.
    Tested as
    Storage access questions.
    Trap
    Issuing long-lived or overly broad SAS tokens.

  • Service endpoint vs. private endpoint

    A service endpoint restricts a PaaS resource to a subnet but keeps its public endpoint; a private endpoint gives it a private IP and removes public exposure.

    Remember
    Private endpoints remove public internet exposure.
    Tested as
    PaaS access questions.
    Trap
    Treating them as equivalent.

  • NSG vs. ASG

    NSGs filter traffic by rules; ASGs group resources so NSG rules can reference the group.

    Remember
    ASGs simplify NSG rule management.
    Tested as
    Network filtering questions.
    Trap
    Expecting an ASG to filter traffic on its own.

  • NSG vs. Azure Firewall vs. WAF

    NSGs filter by port and address; Azure Firewall provides centralized stateful filtering and inspection; a WAF protects web apps at layer 7.

    Remember
    An NSG does not inspect application content.
    Tested as
    Control selection questions.
    Trap
    Assuming an NSG replaces a WAF or firewall inspection.

  • Transparent Data Encryption (TDE)

    Encrypts the whole database at rest automatically.

    Remember
    It protects data at rest, not from authorized administrators.
    Tested as
    Database encryption questions.
    Trap
    Confusing it with Always Encrypted.

  • Always Encrypted

    Encrypts specific sensitive columns so even administrators cannot see plaintext.

    Remember
    Keys stay with the client, not the database engine.
    Tested as
    Database encryption questions.
    Trap
    Confusing it with TDE.

  • Dynamic data masking

    Hides data in query results without changing stored data.

    Remember
    It obscures display, not storage, and is not an access control.
    Tested as
    Database protection questions.
    Trap
    Treating it as encryption or real access control.

  • Defender for Storage and Databases

    Threat protection that detects malware uploads, SQL injection and anomalous access.

    Remember
    It adds detection on top of configuration hardening.
    Tested as
    Threat protection questions.
    Trap
    Expecting it to replace access controls.

  • Private Link

    Exposes a service privately into a virtual network through a private endpoint.

    Remember
    It keeps traffic on the Microsoft backbone, off the public internet.
    Tested as
    Private access questions.
    Trap
    Confusing the Private Link service with a private endpoint.

  • Network Watcher

    Diagnostics that show effective security rules and traffic flow.

    Remember
    Use it to find which rule actually blocks or allows traffic.
    Tested as
    Troubleshooting questions.
    Trap
    Guessing at rule precedence instead of checking effective rules.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Service endpoint vs. private endpoint

ConceptMeaningKey differenceCommon trap
Service endpoint Restricts a PaaS resource to a subnet Keeps the resource's public endpoint Thinking it removes public exposure
Private endpoint Gives the resource a private IP in the virtual network Removes public internet exposure Confusing it with a service endpoint

NSG vs. ASG vs. Azure Firewall vs. WAF

ConceptMeaningKey differenceCommon trap
NSG Filters traffic by source, destination, port and protocol Basic stateful filtering, no content inspection Expecting application-layer inspection
ASG Groups resources for NSG rules Simplifies rule management, does not filter alone Expecting it to filter traffic
Azure Firewall Centralized stateful filtering with inspection in Premium Network-wide policy and deeper inspection Confusing it with an NSG
WAF Protects web applications at layer 7 Blocks web attacks such as injection Using an NSG for web application threats

TDE vs. Always Encrypted vs. dynamic data masking

ConceptMeaningKey differenceCommon trap
TDE Encrypts the whole database at rest Transparent to applications and administrators Expecting it to hide data from admins
Always Encrypted Encrypts specific columns end to end Admins cannot see plaintext Confusing it with TDE
Dynamic data masking Masks data in query results Display only, not storage or access control Treating it as encryption

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Service endpoint for isolation

    What candidates pick
    Use a service endpoint to remove a storage account's public exposure.
    Why it looks right
    It restricts access to a subnet.
    Why it's wrong
    A service endpoint keeps the resource's public endpoint. A private endpoint gives it a private IP and removes public exposure.

    Clue to watch for The requirement is no public internet exposure or a private IP.

  2. NSG as a WAF

    What candidates pick
    Rely on an NSG to block web application attacks such as SQL injection.
    Why it looks right
    NSGs filter traffic.
    Why it's wrong
    NSGs filter by port and address and do not inspect application content. A Web Application Firewall is needed.

    Clue to watch for The threat is a web application attack at layer 7.

  3. TDE hides from admins

    What candidates pick
    Use Transparent Data Encryption to hide sensitive columns from database administrators.
    Why it looks right
    TDE is the standard database encryption.
    Why it's wrong
    TDE encrypts at rest and is transparent to authorized users. Always Encrypted hides specific columns from administrators.

    Clue to watch for The requirement is that administrators cannot see certain data.

  4. Account key everywhere

    What candidates pick
    Share the storage account key with applications for access.
    Why it looks right
    It is simple and grants full access.
    Why it's wrong
    Account keys grant full access and are hard to rotate. Scoped SAS tokens or Entra ID are safer.

    Clue to watch for The requirement is scoped, time-limited or identity-based access.

  5. ASG filters traffic

    What candidates pick
    Expect an application security group to filter traffic on its own.
    Why it looks right
    It is a network security feature.
    Why it's wrong
    ASGs group resources so NSG rules can reference them. The NSG does the filtering.

    Clue to watch for The question asks what actually enforces the rule.

  6. Masking is access control

    What candidates pick
    Use dynamic data masking to prevent unauthorized users from accessing sensitive data.
    Why it looks right
    It hides data in results.
    Why it's wrong
    Masking only obscures display and does not restrict access or change stored data. Access control and encryption are separate.

    Clue to watch for The requirement is to prevent access rather than obscure display.

Answer framework

For any Domain 2 data or network scenario, use these steps before choosing an answer.

  1. Identify whether the requirement is storage, database or network security, since each has its own controls.
  2. For network isolation, choose a private endpoint when public exposure must be removed, and a service endpoint only when a public endpoint is acceptable.
  3. Match the filtering need to the right control: NSG for basic rules, ASG to group resources, Azure Firewall for central policy and WAF for web attacks.
  4. For data, choose the protection that fits: Entra ID or SAS over account keys, TDE for at-rest, Always Encrypted to hide columns from admins, and masking only for display.
  5. Add Defender for Storage or Databases for threat detection, and use Network Watcher to confirm which rules actually apply.

Practice question

A company must ensure its Azure SQL Database protects specific columns of personal data so that even database administrators cannot read the plaintext values. Which feature should the security engineer implement?

Want more like this? The SC-500 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this group the most study time, since it is the heaviest at 25 to 30%. Start with networking, because it has the most look-alike controls. Build a table that separates service endpoints from private endpoints, and NSGs, ASGs, Azure Firewall and WAF, noting for each what it does and what it cannot do. The exam leans hard on these distinctions.

Next, study storage access, keeping account keys, shared access signatures and Entra ID clear, and learn Storage firewall rules and Defender for Storage. Then cover databases, drilling the TDE versus Always Encrypted versus dynamic data masking distinction, which is a frequent trap.

Add Defender for Storage and Databases as the threat-detection layer on top of configuration, and learn Network Watcher for troubleshooting effective rules. Hands-on practice in an Azure subscription, creating a private endpoint and testing storage access methods, makes these concrete. Afterwards, move to group 3, securing compute, which includes the new AI security content.

FAQ

How much of SC-500 is this functional group?

Secure storage, databases, and networking is 25 to 30% of the exam, the largest of the four groups.

What is the difference between a service endpoint and a private endpoint?

A service endpoint restricts a PaaS resource to a subnet but keeps its public endpoint. A private endpoint gives the resource a private IP in your virtual network and removes public internet exposure.

Can an NSG replace a Web Application Firewall?

No. An NSG filters by source, destination, port and protocol and does not inspect application content. A Web Application Firewall protects web apps against layer-7 attacks such as injection.

What is the difference between TDE and Always Encrypted?

Transparent Data Encryption encrypts the whole database at rest and is transparent to authorized users. Always Encrypted encrypts specific columns so even administrators cannot see the plaintext.

Which storage access method is safest?

Microsoft Entra ID authorization is preferred. Shared access signatures are scoped and time-limited, while account keys grant full access and are hard to rotate.

What does Defender for Storage add?

Threat detection such as malware upload detection and alerts on unusual access, on top of configuration hardening like firewall rules and access policies.

How does this group connect to the rest of the exam?

It secures the data and network within the identity and access model from group 1, and its configurations are monitored for posture in group 4.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered storage, database and network security, from private endpoints to Always Encrypted. Test whether you can choose the right control and know its limits under exam conditions.

Take the SC-500 practice test Check your SC-500 readiness

Keep going