Master every AZ-500 domain: identity and access management with Conditional Access and PIM, secure networking with Azure Firewall and DDoS Protection, storage and database security with Key Vault and SQL Advanced Threat Protection, and security operations with Defender for Cloud and Microsoft Sentinel. 60 practice questions, no signup required.
| Exam fact | Details |
|---|---|
| Exam code | AZ-500 |
| Full name | Microsoft Azure Security Engineer Associate |
| Questions | 40–60 (mix of MCQ, case studies, drag-and-drop) |
| Passing score | 700 / 1000 |
| Duration | 120 minutes |
| Price | $165 USD |
| Prerequisites | AZ-104 recommended, 1+ year hands-on Azure security experience |
| Renewal | Free annual online assessment (no re-exam required) |
Understand the identity layer that underpins every AZ-500 domain. Learn the difference between Microsoft Entra ID Free, P1, and P2, and when each feature unlocks. Covers hybrid identity with Entra Connect, cloud-only accounts, guest (B2B) vs consumer (B2C) identities, and the administrative units model.
Master the access control triad that dominates the exam. Build Conditional Access policies that enforce MFA based on sign-in risk, location, and device compliance. Configure Privileged Identity Management (PIM) for just-in-time role activation with approval workflows and access reviews. Design RBAC with custom roles and least-privilege assignments at management group, subscription, resource group, and resource scope.
Protect Azure network perimeters and internal traffic flows. Compare Azure Firewall Standard vs Premium (IDPS, TLS inspection), configure Network Security Groups with service tags and Application Security Groups (ASG), and deploy DDoS Protection Standard with mitigation metrics. Understand when to use Azure Bastion vs JIT VM access, and when Private Endpoints are mandatory.
Secure secrets, keys, and certificates at rest and in transit. Configure Key Vault with soft-delete and purge protection, choose between RBAC and access policy models, and integrate customer-managed keys (CMK) with Storage and SQL. Compare Azure Disk Encryption (ADE using BitLocker/DM-Crypt) with SSE + CMK. Apply SAS tokens, storage account firewall rules, immutable storage, and private endpoint to blob and file shares.
Extend security to compute and data workloads. Enable SQL Transparent Data Encryption (TDE), Dynamic Data Masking, Always Encrypted for column-level protection, and SQL Auditing with Log Analytics. Secure AKS clusters with Entra ID RBAC, pod-managed identity, Azure Policy, network policies, and image scanning via Microsoft Defender for Containers. Harden VMs with JIT access, endpoint protection assessments, and adaptive application controls.
Defender for Cloud is the exam's primary security operations tool. Understand the Secure Score model and how recommendations map to controls and regulatory standards. Enable workload protections: Defender for Servers (MDE integration, JIT, Qualys), Defender for Storage (malware scanning, sensitive data discovery), Defender for SQL, Defender for Containers, and Defender for App Service. Use regulatory compliance dashboards to track CIS, NIST 800-53, and PCI DSS posture.
Microsoft Sentinel is the cloud-native SIEM/SOAR that ties together all AZ-500 security signals. Connect data connectors (Azure Activity, Microsoft 365 Defender, CEF/Syslog), write scheduled and NRT analytics rules with KQL, manage incidents and alerts, and build SOAR playbooks with Logic Apps. Use threat hunting with bookmarks, entity behavior analytics (UEBA), and Workbooks for visualization. Understand workspace design: cost, data retention, and cross-workspace queries.
Conditional Access controls how someone signs in (require MFA, compliant device). PIM controls what roles they can activate after signing in — it's the last mile of least-privilege for admin access. Both appear heavily on AZ-500.
Access policies are the legacy model — they work at the vault level, not per-key. RBAC is Microsoft's recommended model: assign Key Vault Secrets User or Key Vault Crypto Officer scoped to individual secrets. AZ-500 expects you to know both models and the tradeoffs.
Defender for Cloud has its own Secure Score for resource posture. Sentinel has no Secure Score — it's a SIEM. Many candidates confuse the two. On exam day: Secure Score = Defender for Cloud; analytics rules + incidents = Sentinel.
60 scenario-based practice questions — instant scoring, no signup. Your progress is saved locally.
Need deep-dives while commuting? The CertQuests podcast covers AZ-500 domains in audio format — perfect for reinforcing concepts on the go.