Microsoft AZ-500 Azure Security Practice Test

AZ-500 is Microsoft’s Azure Security Engineer Associate exam route for candidates who implement, manage, and monitor security controls across Azure, hybrid, and multicloud environments.

Microsoft currently lists the Azure Security Engineer Associate certification, related exam, and renewal assessments as retiring on August 31, 2026. Use this page if AZ-500 is still your scheduled exam, your employer asks for Azure Security Engineer preparation, or you need to compare Azure-native security with newer Microsoft cloud and AI security routes such as SC-500 .

AZ-500 exam snapshot

What AZ-500 is really testing

AZ-500 vs SC-500

Sample Exam Questions

Try these 12 original Microsoft AZ-500 sample questions. They are designed for self-assessment and are not official Microsoft exam questions.

Question 1

What this tests: Conditional Access

A security team wants all users in privileged Microsoft Entra roles to complete multifactor authentication when they sign in from untrusted locations. The team also wants to block legacy authentication. Which control is the best fit?

• A. Add a network security group rule to the virtual network
• B. Create Conditional Access policies that target privileged roles, require MFA outside trusted locations, and block legacy authentication
• C. Store the administrator passwords in Azure Key Vault only
• D. Enable a storage account firewall rule for the tenant

Best answer: B

Explanation: Conditional Access is the policy engine for sign-in conditions such as user or role, location, authentication strength, and legacy authentication. Network security groups and storage firewalls protect network or storage paths, not identity sign-in conditions. Key Vault protects secrets but does not enforce user sign-in requirements.

Question 2

What this tests: managed identities and Key Vault

An Azure App Service app needs to retrieve a secret from Key Vault. The team wants to avoid storing credentials in configuration files or deployment variables. What should it do?

• A. Put the Key Vault secret value directly in an app setting
• B. Use a shared administrator account for the app
• C. Export the secret to a protected spreadsheet
• D. Enable a managed identity for the app and grant that identity the minimum required Key Vault permission

Best answer: D

Explanation: Managed identities let Azure workloads authenticate to supported services without embedded credentials. Granting only the required Key Vault permission keeps access limited and auditable. Storing secrets in app settings, shared accounts, or spreadsheets increases exposure and weakens rotation and accountability.

Question 3

What this tests: secure administrative access

A virtual machine must be administered without exposing RDP or SSH directly to the internet. Which design best reduces public attack surface?

• A. Remove public VM exposure and use a private administrative path such as Azure Bastion, VPN, ExpressRoute, or just-in-time access where appropriate
• B. Keep RDP open to the internet but use a complex password
• C. Add a public IP address to every subnet
• D. Disable all monitoring so failed sign-ins are not logged

Best answer: A

Explanation: AZ-500 scenarios often test secure access path selection. Removing public exposure and using private or controlled administrative access reduces risk. Strong passwords help but do not justify exposing management ports. Public IP expansion and disabled monitoring move in the wrong direction.

Question 4

What this tests: storage security

A storage account contains private customer documents. The organization wants to prevent accidental public blob access and require secure transport. Which configuration is most appropriate?

• A. Enable anonymous blob access so files are easier to share
• B. Move the files to a public container and rely on obscured URLs
• C. Disable public blob access, require secure transfer, and use private endpoints or firewall rules where needed
• D. Give every developer Storage Blob Data Owner

Best answer: C

Explanation: Storage security combines public-access prevention, transport protection, network controls, and least privilege. Public containers and obscured URLs are not suitable for private customer documents. Broad data-owner access should be avoided unless the role is truly required.

Question 5

What this tests: Defender for Cloud prioritization

Microsoft Defender for Cloud reports several recommendations across compute, storage, and identity. What is the best way to prioritize remediation?

• A. Fix the newest recommendation first regardless of risk
• B. Consider severity, affected resources, exposure, business impact, and regulatory requirements before scheduling remediation
• C. Ignore all recommendations until an incident occurs
• D. Remediate only recommendations for nonproduction subscriptions

Best answer: B

Explanation: Security posture management is risk-based. Severity, exposure, business criticality, and compliance obligations help determine what should be fixed first. Age alone is not enough, and ignoring production or compliance-sensitive findings creates avoidable risk.

Question 6

What this tests: Key Vault governance

A team uses Azure Key Vault for production encryption keys. Which combination best supports secure operations?

• A. Give all project users full key permissions for convenience
• B. Store key backups in public storage
• C. Disable audit logging after deployment
• D. Use least-privilege access, enable logging, and protect keys with safeguards such as soft delete and purge protection where appropriate

Best answer: D

Explanation: Key Vault operations should be restricted, monitored, and protected from accidental or malicious deletion. Broad permissions, public backups, and disabled logs undermine the purpose of centralized key protection.

Question 7

What this tests: RBAC versus network controls

A user can reach a storage endpoint over the network but receives an authorization error when trying to read blobs. What is the most likely control gap?

• A. The user or workload identity lacks the required role or data-plane permission
• B. The virtual network has too many subnets
• C. The public IP address is too old
• D. The storage account name is too short

Best answer: A

Explanation: Network reachability and authorization are separate layers. A user can reach an endpoint but still fail if RBAC, ACLs, or data-plane permissions do not allow the requested action. AZ-500 questions often require separating reachability from permission.

Question 8

What this tests: just-in-time VM access

A security engineer wants to reduce standing exposure for VM management ports while still allowing approved administrators to connect for short maintenance windows. Which feature is the best match?

• A. A permanent allow rule from any internet source
• B. A public storage container
• C. Just-in-time VM access through Microsoft Defender for Cloud
• D. A shared local administrator password

Best answer: C

Explanation: Just-in-time VM access limits management-port exposure by opening access only when approved and only for a defined window and source. Permanent internet exposure and shared administrator credentials increase attack surface.

Question 9

What this tests: database security monitoring

An Azure SQL workload stores sensitive data. The team needs audit evidence and alerts for suspicious activity. What should be part of the design?

• A. Disable audit logs to reduce storage costs
• B. Enable appropriate SQL auditing, threat detection or Defender capabilities, and least-privilege access controls
• C. Put all users in a database owner role
• D. Export the database weekly and delete all activity records

Best answer: B

Explanation: Database security needs access control, audit evidence, and detection. SQL auditing and threat-protection capabilities help support investigation and compliance. Removing logs or assigning broad owner permissions weakens accountability.

Question 10

What this tests: incident response

An alert suggests that a production VM may be compromised. What should the security engineer do before deleting the resource?

• A. Delete the VM immediately and close the incident
• B. Disable all logging to reduce noise
• C. Announce the root cause before gathering evidence
• D. Preserve relevant logs, alerts, snapshots, and investigation evidence according to the incident process

Best answer: D

Explanation: Incident response requires evidence preservation before destructive cleanup. Logs, alerts, disk snapshots, timeline data, and related signals may be needed to determine scope and root cause. Deleting resources first can destroy evidence.

Question 11

What this tests: privileged access

An administrator needs occasional Global Administrator access for a planned change, but the organization wants to avoid standing privilege. Which Microsoft Entra feature is the best fit?

• A. Privileged Identity Management with eligible, time-bound activation and approval or MFA controls as required
• B. A permanently assigned Global Administrator role for every engineer
• C. A shared emergency account used for all routine work
• D. A firewall rule that grants directory permissions

Best answer: A

Explanation: Privileged Identity Management supports just-in-time privileged role activation, approvals, MFA, justification, and auditing. Permanent broad roles and shared accounts make privilege harder to control and investigate.

Question 12

What this tests: Azure Policy

A company wants to prevent new resources from being deployed in unapproved regions and audit existing resources that violate tagging standards. Which Azure capability is most appropriate?

• A. Azure DNS
• B. A local spreadsheet checklist
• C. Azure Policy assignments and initiatives
• D. A VM custom script extension only

Best answer: C

Explanation: Azure Policy can enforce, deny, audit, or remediate configuration rules at management-group, subscription, resource-group, or resource scope. It is designed for governance at scale. Manual checklists and VM scripts do not provide consistent policy enforcement across Azure resources.

Quick Cheat Sheet

Official sources

• Microsoft Certified: Azure Security Engineer Associate
• Microsoft Learn course SC-500T00-A

What to open next

• Use SC-500 if your goal is Microsoft cloud and AI security.
• Use Security+ SY0-701 if you need baseline cybersecurity practice first.
• Use AZ-104 if Azure administration is the blocker before security specialization.

In this section

• Microsoft AZ-500 Cheat Sheet: Azure Security
  Review a compact Microsoft AZ-500 cheat sheet for Azure Security Technologies, including identity, network security, workload protection, data security, monitoring, and SC-500 comparison cues.