AZ-500 Exam Guide 2026: Retired Exam Reference and FREE SC-500 Path
Video
You need to enforce MFA for all administrative accounts in Azure. Which feature should you use?
Az500 Identity Access
Question · Easy
Free 2026 AZ-500 Azure Security Engineer reference: the exam retired August 31, 2026 and SC-500 replaced it. Final January 2026 outline, 4 weighted domains, labs, and the move to SC-500.
Blog
What is the primary purpose of Microsoft Entra Privileged Identity Management (PIM)?
Chapter 1: Exam Overview & Azure Security Architecture Foundation
1.1 Azure Security Engineer Role & Exam Logistics
Study guide
Your organization uses Microsoft Entra Connect to synchronize on-premises AD with Microsoft Entra ID. You need to implement MFA for cloud-based users only. What should you do?
Question · Medium
Tech Exam Prep Podcast
Listen on Spotify
Podcast
You need to configure an access review for all users assigned to the Global Administrator role. Which tool should you use?
An application needs to access Azure Key Vault to retrieve secrets without using credentials stored in code. Which authentication method should you implement?
You need to require MFA for users accessing Azure Management portal from outside the corporate network. Which Conditional Access condition should you configure?
1.2 Microsoft Cybersecurity Reference Architecture & Zero Trust Principles
Which three methods are supported for passwordless authentication in Microsoft Entra ID? (Choose three)
You configure a Conditional Access policy requiring MFA for all users. A user reports they cannot authenticate to an older IMAP email client. What is the likely cause and solution?
Question · Hard
Which Azure service provides centralized network security group (NSG) management across multiple virtual networks?
Az500 Network Security
You need to filter inbound traffic to a web application based on OWASP core rule sets. Which Azure service should you use?
Chapter 2: Secure Identity and Access - Authentication, MFA & PIM
2.1 Microsoft Entra ID Security, Users, and Groups
Which Azure service provides secure RDP/SSH access to Azure VMs without exposing public IP addresses?
You need to secure traffic between Azure services and Azure PaaS services like Azure Storage. Which feature should you use to keep traffic on the Azure backbone network?
You have multiple NSGs applied to a VM: one at the subnet level and one at the NIC level. How is inbound traffic evaluated?
You need to implement a hub-and-spoke network topology with centralized firewall inspection for all traffic between spokes. What should you configure?
2.2 Authentication Methods, MFA, and Conditional Access Policy Design
Which feature of Azure Firewall Premium provides intrusion detection and prevention capabilities?
You need to restrict access to Azure Storage account to only specific virtual networks while still allowing access from on-premises via ExpressRoute. What should you configure?
What is the difference between Application Security Groups (ASGs) and Network Security Groups (NSGs)?
You configure Azure DDoS Protection Standard. Which three features are included? (Choose three)
2.3 Microsoft Entra Privileged Identity Management (PIM)
You need to secure access to an Azure SQL Database from an Azure VM without using public endpoints. What is the most secure solution?
You have Azure Firewall configured with Threat Intelligence in Alert and Deny mode. A legitimate application is being blocked because its destination IP is flagged as malicious in the Microsoft Threat Intelligence feed. What should you do?
You configure forced tunneling on an Azure Firewall subnet. What additional route must be configured to ensure the firewall continues to function properly?
Which Azure Key Vault feature automatically rotates keys at a specified interval?
Az500 Compute Storage Security
Chapter 3: Secure Identity and Access - RBAC & Workload Identity
3.1 Azure RBAC, Custom Roles, and Governance
What is the purpose of Azure Disk Encryption (ADE) for virtual machines?
Which feature of Azure SQL Database provides automatic detection and remediation of potential security vulnerabilities?
You need to grant limited access to a blob in Azure Storage for a specific time period. Which mechanism should you use?
You need to ensure that sensitive data in an Azure SQL Database column is encrypted and that only authorized applications can see the decrypted values. Which feature should you use?
3.2 Workload Identities and Managed Identities
You are configuring pod security for Azure Kubernetes Service (AKS). Which policy should you use to prevent containers from running as root?
Which Azure Container Registry (ACR) feature automatically scans images for vulnerabilities when pushed to the registry?
You need to encrypt data in Azure Cosmos DB. Which encryption option is enabled by default?
What is the purpose of Azure Confidential Computing?
3.3 External Identities and Cross-Tenant Collaboration
You need to ensure that a specific user can only see a subset of rows in an Azure SQL Database table based on their department. Which feature should you implement?
Which Key Vault setting prevents accidental or malicious permanent deletion of keys, secrets, and certificates?
You are enabling Azure Disk Encryption (ADE) on a new Azure VM. What is the required identity configuration before enabling encryption?
You configure an AKS cluster with Microsoft Entra Workload ID. A pod fails to authenticate to Azure Key Vault using a federated identity credential. What is the most likely cause?
Chapter 4: Microsoft Entra Application Access & Consent Governance
4.1 Enterprise Applications, OAuth Permission Grants & Consent Governance
What does the Secure Score in Microsoft Defender for Cloud represent?
Az500 Defender Sentinel
Which Microsoft Defender for Cloud plan provides protection for SQL databases on Azure VMs?
Loading more…
