Microsoft Azure Security Technologies (AZ-500) Practice Exam

The Microsoft Azure Security Technologies (AZ-500) exam validates your expertise in implementing and managing security solutions for cloud-based resources in Microsoft Azure, hybrid environments, and multi-cloud deployments. Earning this certification demonstrates your ability to safeguard identities, secure infrastructure, protect data, and effectively respond to security threats within the Azure ecosystem.

Who Should Take This Exam?

The AZ-500 certification is ideal for IT professionals with experience in cloud security and a focus on Microsoft Azure, including:

• Cloud Security Architects: Designing and implementing secure cloud architectures leveraging Azure security services.
• Security Engineers: Securing and managing Azure resources, identities, and data using Microsoft security tools.
• Cloud Administrators: Enhancing their understanding of Azure security best practices for infrastructure and application protection.
• Anyone seeking to: Demonstrate their proficiency in securing cloud environments using Microsoft Azure security technologies.

Are There Prerequisites?

While there are no formal prerequisites, Microsoft recommends that candidates possess:

• Prior experience with implementing security controls and solutions.
• A foundational understanding of security concepts and principles (identity and access management, network security, data encryption).
• Working knowledge of Azure services, including Azure Active Directory, Azure Security Center, and Azure Monitor.

Roles and Responsibilities of an AZ-500 Certified Professional

With the AZ-500 certification, you may qualify for roles such as:

• Azure Security Engineer: Implementing, managing, and monitoring security solutions across Azure subscriptions.
• Cloud Security Architect: Designing and architecting secure cloud solutions on Microsoft Azure.
• Security Operations Center (SOC) Analyst: Responding to security incidents and threats within the Azure environment.

Exam Details

• Exam Format: Multiple-choice questions (number of questions not specified by Microsoft)
• Delivery Method: Proctored online exam or testing center.
• Duration: 180 minutes

Course Outline 

Domain 1 - Understanding Manage identity and access (25–30%)

1.1 Explain to manage identities in Azure AD

• Learn secure users in Azure AD
• Learn secure directory groups in Azure AD
• Learn to recommend when to use external identities
• Learn secure external identities
• Learn to implement Azure AD Identity Protection

1.2 Explain to manage authentication by using Azure AD

• Learn to configure Microsoft Entra Verified ID
• Learn to implement multi-factor authentication (MFA)
• Learn to implement passwordless authentication
• Learn to implement password protection
• Learn to implement single sign-on (SSO)
• Learn to integrate single sign on (SSO) and identity providers
• Learn to recommend and enforce modern authentication protocols

1.3 Explain to manage authorization by using Azure AD

• Learn to configure Azure role permissions for management groups, subscriptions, resource groups, and resources
• Learn to assign built-in roles in Azure AD
• Learn to assign built-in roles in Azure
• Learn to create and assign custom roles, including Azure roles and Azure AD roles
• Learn to implement and manage Microsoft Entra Permissions Management
• Learn to configure Azure AD Privileged Identity Management (PIM)
• Learn to configure role management and access reviews by using Microsoft Entra Identity Governance
• Learn to implement Conditional Access policies

1.4 Explain to manage application access in Azure AD

• Learn to manage access to enterprise applications in Azure AD, including OAuth permission grants
• Learn to manage app registrations in Azure AD
• Learn to configure app registration permission scopes
• Learn to manage app registration permission consent
• Learn to manage and use service principals
• Learn to manage managed identities for Azure resources
• Learn to recommend when to use and configure an Azure AD Application Proxy, including authentication

Domain 2 - Understanding Secure networking (20–25%)

2.1 Explain plan and implement security for virtual networks

• Learn to plan and implement Network Security Groups (NSGs) and Application Security Groups (ASGs)
• Learn to plan and implement user-defined routes (UDRs)
• Learn to plan and implement VNET peering or VPN gateway
• Learn to plan and implement Virtual WAN, including secured virtual hub
• Learn secure VPN connectivity, including point-to-site and site-to-site
• Learn to implement encryption over ExpressRoute
• Learn to configure firewall settings on PaaS resources
• Learn to monitor network security by using Network Watcher, including NSG flow logging

2.2 Explain plan and implement security for private access to Azure resources

• Learn to plan and implement virtual network Service Endpoints
• Learn to plan and implement Private Endpoints
• Learn to plan and implement Private Link services
• Learn to plan and implement network integration for Azure App Service and Azure Functions
• Learn to plan and implement network security configurations for an App Service Environment (ASE)
• Learn to plan and implement network security configurations for an Azure SQL Managed Instance

2.3 Explain plan and implement security for public access to Azure resources

• Learn to plan and implement TLS to applications, including Azure App Service and API Management
• Learn to plan, implement, and manage an Azure Firewall, including Azure Firewall Manager and firewall policies
• Learn to plan and implement an Azure Application Gateway
• Learn to plan and implement an Azure Front Door, including Content Delivery Network (CDN)
• Learn to plan and implement a Web Application Firewall (WAF)
• Learn to recommend when to use Azure DDoS Protection Standard

Domain 3 - Understanding Secure compute, storage, and databases (20–25%)

3.1 Explain plan and implement advanced security for compute

• Learn to plan and implement remote access to public endpoints, including Azure Bastion and JIT
• Learn to configure network isolation for Azure Kubernetes Service (AKS)
• Learn to secure and monitor AKS
• Learn to configure authentication for AKS
• Learn to configure security monitoring for Azure Container Instances (ACIs)
• Learn to configure security monitoring for Azure Container Apps (ACAs)
• Learn to manage access to Azure Container Registry (ACR)
• Learn to configure disk encryption, including Azure Disk Encryption (ADE), encryption as host, and confidential disk encryption
• Learn to recommend security configurations for Azure API Management

3.2 Explain plan and implement security for storage

• Learn to configure access control for storage accounts
• Learn to manage life cycle for storage account access keys
• Learn to select and configure an appropriate method for access to Azure Files
• Learn to select and configure an appropriate method for access to Azure Blob Storage
• Learn to select and configure an appropriate method for access to Azure Tables
• Learn to select and configure an appropriate method for access to Azure Queues
• Learn to select and configure appropriate methods for protecting against data security threats, including soft delete, backups, versioning, and immutable storage
• Learn to configure Bring your own key (BYOK)
• Learn to enable double encryption at the Azure Storage infrastructure level

3.3 Explain plan and implement security for Azure SQL Database and Azure SQL Managed Instance

• Learn to enable database authentication by using Microsoft Azure AD
• Learn to enable database auditing
• Learn to identify use cases for the Microsoft Purview governance portal
• Learn to implement data classification of sensitive information by using the Microsoft Purview governance portal
• Learn to plan and implement dynamic masking
• Learn to implement Transparent Database Encryption (TDE)
• Learn to recommend when to use Azure SQL Database Always Encrypted

Domain 4 - Understanding to manage security operations (25–30%)

4.1 Explain to plan, implement, and manage governance for security

• Learn to create, assign, and interpret security policies and initiatives in Azure Policy
• Learn to configure security settings by using Azure Blueprint
• Learn to deploy secure infrastructures by using a landing zone
• Learn to create and configure an Azure Key Vault
• Learn to recommend when to use a Dedicated HSM
• Learn to configure access to Key Vault, including vault access policies and Azure Role Based Access Control
• Learn to manage certificates, secrets, and keys
• Learn to configure key rotation
• Learn to configure backup and recovery of certificates, secrets, and keys

4.2 Explain to manage security posture by using Microsoft Defender for Cloud

• Learn to identify and remediate security risks by using the Microsoft Defender for Cloud Secure Score and Inventory
• Learn to assess compliance against security frameworks and Microsoft Defender for Cloud
• Learn to add industry and regulatory standards to Microsoft Defender for Cloud
• Learn to add custom initiatives to Microsoft Defender for Cloud
• Learn to connect hybrid cloud and multi-cloud environments to Microsoft Defender for Cloud
• Learn to identify and monitor external assets by using Microsoft Defender External Attack Surface Management

4.3 Explain to configure and manage threat protection by using Microsoft Defender for Cloud

• Learn to enable workload protection services in Microsoft Defender for Cloud, including Microsoft Defender for Storage, Databases, Containers, App Service, Key Vault, Resource Manager, and DNS
• Learn to configure Microsoft Defender for Servers
• Learn to configure Microsoft Defender for Azure SQL Database
• Learn to manage and respond to security alerts in Microsoft Defender for Cloud
• Learn to configure workflow automation by using Microsoft Defender for Cloud
• Learn to evaluate vulnerability scans from Microsoft Defender for Server

4.4 Explain Configure and manage security monitoring and automation solutions

• Learn to monitor security events by using Azure Monitor
• Learn to configure data connectors in Microsoft Sentinel
• Learn to create and customize analytics rules in Microsoft Sentinel
• Learn to evaluate alerts and incidents in Microsoft Sentinel
• Learn to configure automation in Microsoft Sentinel