RetiredCurrent: SC-500

Microsoft · AZ-500 · Associate

Microsoft Azure Security Technologies

Name: Pass-IT
Author: Pass-IT

This exam has been retired.

50Mock exam questions

100minTime limit

700/ 1000Passing score

Overview

About the exam

The AZ-500 certification validates skills in implementing security controls and threat protection, managing identity and access, and securing data, applications, and networks in Azure and hybrid environments. It covers Microsoft Entra ID, Azure Defender, Microsoft Sentinel, Azure Key Vault, network security groups, Azure Firewall, and security monitoring and response capabilities.

This certification is designed for Azure security engineers who implement, manage, and monitor security across Azure infrastructure, applications, and data. Candidates should have strong experience with Azure administration, scripting, and networking, plus familiarity with cloud security best practices and compliance requirements.

Try the practice preview

Try five AZ-500 questions

Try five practice questions from the app’s current Microsoft Azure Security Technologies question bank, with answers and explanations.

Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel1 / 5

You need Microsoft Sentinel security logs to remain available for compliance for 2 years. The workspace keeps Sentinel analytics logs interactively for 90 days, and you want to retain older data at lower cost without moving the table out of the analytics tier. What should you configure for the relevant tables?

AlexFull explanation from Alex

Use table-level total retention for long-term compliance retention. In a Microsoft Sentinel workspace, analytics retention keeps data available for near-real-time analytics, alerting, hunting, and workbooks. Total retention extends retention beyond that interactive period for long-term access. Configure the relevant tables with total retention of 730 days for two years. Increasing analytics retention to 730 days can also keep data interactive, but it is not the lower-cost approach when only older compliance data needs occasional access. Moving a table to the data lake tier only is a different choice that can remove real-time Sentinel capabilities for that data.

Sourcelearn.microsoft.com

Secure identity and access2 / 5

You need to configure Microsoft Entra ID to send risk detection events to a SIEM system in real-time. Which diagnostic setting should you enable on Microsoft Entra ID?

AlexFull explanation from Alex

CORRECT: RiskyUsers and UserRiskEvents logs. Per Microsoft docs, organizations export risk detection data by configuring diagnostic settings for RiskyUsers and UserRiskEvents in Microsoft Entra ID, enabling real-time SIEM streaming via Event Hubs or Log Analytics. WRONG answers: SigninLogs only captures authentication events but not Identity Protection risk assessments or risk levels. ProvisioningLogs only tracks user provisioning lifecycle, not risk events. AuditLogs only captures directory changes but does not include Identity Protection risk detections.

Sourcelearn.microsoft.com

Secure compute, storage, and databases3 / 5

You are configuring Azure Storage security. You need to restrict access using SAS tokens and network controls. For each of the following statements, select Yes if the statement is true. Otherwise, select No. 1. A user delegation SAS is secured with Microsoft Entra credentials instead of the storage account key. 2. An account SAS can delegate access to resources across multiple storage services simultaneously. 3. Stored access policies can be used with account SAS to provide revocation capability. 4. When a private endpoint is created for a storage account, clients on the VNet connect using the same connection strings as before.

AlexFull explanation from Alex

CORRECT: Yes, Yes, No, Yes. Per Microsoft docs: (1) YES—User delegation SAS is 'secured with Microsoft Entra credentials instead of the account key,' providing superior security. (2) YES—Account SAS 'delegates access to resources in one or more of the storage services' simultaneously, unlike service SAS which is limited to one service. (3) NO—'Stored access policies are not supported for the user delegation SAS or the account SAS.' Only service SAS supports stored access policies for revocation. (4) YES—Per docs on private endpoints, 'Clients on a VNet using the private endpoint should use the same connection string.' DNS automatically resolves the FQDN to the private IP.

Sourcelearn.microsoft.com

Secure networking4 / 5

You are configuring Azure Bastion to provide secure RDP access to VMs in a virtual network. Azure Bastion requires a dedicated subnet. What must this subnet be named?

AlexFull explanation from Alex

Azure Bastion requires a dedicated subnet named exactly 'AzureBastionSubnet' (minimum /26). This is a hard naming requirement enforced by Azure—no other name is accepted. The subnet must reside in the same VNet as the Bastion host and cannot contain other resources.

Why distractors are wrong: 'BastionSubnet' is plausible but incorrect—Azure enforces the exact prefix 'AzureBastion.' 'ManagementSubnet' is a generic name with no special Azure meaning. 'GatewaySubnet' is the required name for VPN/ExpressRoute gateways, not Bastion.

Ref: learn.microsoft.com/azure/bastion/configuration-settings

Sourcelearn.microsoft.com

Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel5 / 5

Your organization wants to use Microsoft Defender for Cloud to assess compliance against PCI DSS. Where do you enable this compliance standard?

AlexFull explanation from Alex

CORRECT: Defender for Cloud Regulatory compliance dashboard. Per Microsoft docs, this dashboard provides built-in compliance frameworks including PCI DSS, mapping Azure Policy controls to regulatory requirements. You enable and manage compliance standards directly through this dashboard. WRONG answers: Azure Policy Definitions define individual policies but don't provide an integrated compliance assessment framework. Azure Monitor Alerts handle metric/log alerting, not compliance posture assessment. Sentinel Analytics rules detect security threats using KQL but don't assess regulatory compliance.

Sourcelearn.microsoft.com

Create a free account

Exam domains

What's on the exam

Securing Azure with Microsoft Defender for Cloud and Microsoft Sentinel is the heaviest area at 30–35%, and it is broader than its title: Azure Policy and governance enforcement, Key Vault with certificate, secret and key rotation, secure score and compliance standards, workload protection plans, and Sentinel data connectors and analytics rules all sit inside it. Networking and compute/storage/databases follow at 20–25% each, identity and access at 15–20%.

The ordering is the opposite of what candidates expect from a security exam: identity, usually the first thing taught, is the smallest domain, while posture management and monitoring — the work that starts after everything is configured — is the largest. Its successor SC-500 keeps that ordering and adds a set of AI-workload controls on top, so time spent on Defender for Cloud here is not time wasted.

Exam blueprint: AZ-500

Secure identity and access15–20%

Manage security controls for identity and access (RBAC, custom roles, PIM, MFA, Conditional Access) and manage Microsoft Entra application access and managed identities (enterprise apps, app registrations, service principals, managed identities)

≈ 9 h

Secure networking20–25%

Plan and implement security for virtual networks (NSGs, ASGs, Virtual Network Manager, UDRs, VNet peering, VPN, Virtual WAN, ExpressRoute, firewalls, Network Watcher), private access (Service Endpoints, Private Endpoints, Private Link), and public access (TLS, Azure Firewall, Application Gateway, Front Door, WAF, DDoS Protection)

≈ 12 h

Secure compute, storage, and databases20–25%

Plan and implement advanced security for compute (Bastion, JIT VM access, AKS security, container monitoring, ACR, disk encryption, API Management security), storage security (access control, access keys, Azure Files/Blob access, data protection, BYOK, double encryption), and Azure SQL Database/Managed Instance security (authentication, auditing, dynamic masking, TDE, Always Encrypted)

≈ 12 h

Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel30–35%

Implement and manage cloud governance policies (Azure Policy, Key Vault, certificates/secrets/keys management, key rotation, backup/recovery), manage security posture with Defender for Cloud (Secure Score, compliance, custom standards, multi-cloud, EASM), configure threat protection (workload protection plans, Defender for Servers/Databases/Storage, agentless scanning, vulnerability management, DevOps Security), and configure security monitoring and automation (alerts, workflow automation, DCRs, Sentinel data connectors/analytics rules/automation)

≈ 17 h

Format

Exam format and question types

The exam consists of 40–60 questions to be completed in 100 minutes. Question types include multiple-choice, multiple-select, drag-and-drop, hot area, and case study formats. Questions are scenario-driven, presenting security incidents or compliance requirements and asking you to configure the correct security controls. Lab-based questions may test hands-on security configuration skills.

Question types: AZ-500

Multiple Choice41%

Select the single answer that best meets the question’s requirements.

Drag & Drop17%

Move items into the slots, groups, or sequence specified by the task.

Ordering11%

Arrange the steps in the sequence needed to complete the process.

Multiple Response11%

Select multiple answers. Follow the question’s instructions on how many to choose.

Dropdown11%

Choose options from dropdown menus to complete a statement or configuration.

True / False9%

Decide whether a statement is true or false, paying attention to its conditions and wording.

Study notes

Common pitfalls

Topics to review: AZ-500

01Entra ID Security
Not understanding Conditional Access policies, PIM (Privileged Identity Management), and identity protection configurations.
02Network Isolation
Confusing private endpoints, service endpoints, NSGs, and Azure Firewall for different network security scenarios.
03Key Vault Access
Struggling with Key Vault access policies vs RBAC authorization models and managed identity integration.
04Defender for Cloud
Overlooking Microsoft Defender for Cloud workload protection plans and their specific capabilities per resource type.
05Regulatory Compliance
Not knowing how to implement and assess compliance with regulatory standards using Azure Policy and Defender for Cloud.

Practice with questions and explanations in Pass-IT →

Questions

Frequently asked questions

How long is the Microsoft Azure Security Technologies exam?

The AZ-500 exam has 50 questions and a 100-minute time limit.

What is the passing score for Microsoft Azure Security Technologies?

The passing score for the AZ-500 exam is 700 / 1000.

Which pitfalls should I review when preparing for Microsoft Azure Security Technologies?

Topics to review include Entra ID Security, Network Isolation, Key Vault Access, Defender for Cloud, Regulatory Compliance. Work through examples to check that you understand the distinctions and can explain your answer.

Is AZ-500 still worth taking before it retires?

AZ-500 stops being offered after 31 August 2026 and SC-500 replaces it. If you are days away from sitting it and already prepared, the certification remains valid after retirement; if you are starting now, SC-500 is the exam to prepare for. Our guide walks through both cases. Read the AZ-500 to SC-500 guide

What replaces AZ-500?

SC-500 takes over as Microsoft's Azure security engineering exam. The subject matter overlaps heavily with AZ-500, so preparation you have already done on identity, network isolation and Defender for Cloud carries across rather than being wasted.

What happens to your AZ-500 certification after it retires?

A certification you already hold stays valid for its usual one-year term, and Microsoft's free renewal assessment on Microsoft Learn opens six months before expiry. Retiring the exam stops new candidates from booking it; it does not revoke the credential of people who passed.

Which AZ-500 topics carry the most marks?

Defender for Cloud and Microsoft Sentinel together form the heaviest area at roughly 34%, with secure networking and secure compute, storage and databases around 24% each and identity and access near 18%. Microsoft publishes ranges rather than exact figures, so read these as proportions.