AZ-500: Microsoft Azure Security Technologies
Implement enterprise security controls, maintain security posture, manage identity and access, protect data and applications, and secure hybrid and cloud networks in Microsoft Azure.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Recommended Study Guides & Exam Preparation Blueprints
Reinforce your knowledge with domain breakdowns, trap question analyses, and architectural cheat sheets:
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The AZ-500 exam features 45-60 questions, including scenarios, case studies, and drag-and-drop items within 120 minutes. Cost is $165 USD, with a passing threshold of 700/1000 (70%).
The exam tests four security pillars: (1) Manage identity and access (~25-30%), (2) Secure networking (~20-25%), (3) Secure compute, storage, and databases (~20-25%), and (4) Manage security operations (~25-30%).
PIM provides Just-In-Time (JIT) role activation, time-bound access, approval workflows, mandatory MFA, and comprehensive audit history, eliminating permanent standing administrator privileges.
NSGs provide layer 4 packet filtering based on 5-tuple rules. Azure Firewall is a fully managed, stateful layer 3-7 firewall service featuring threat intelligence, TLS inspection, and FQDN application filtering.
Defender for Cloud integrates Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWPP), continuously assessing resources against CIS and NIST baselines while using behavioral analytics to flag malware and anomalies.
CMK enables organizations to generate, own, and control their own encryption keys stored in FIPS-validated Hardware Security Modules (HSMs) in Key Vault to encrypt data at rest across Azure storage and databases.
ASGs group virtual machine network interfaces based on application tier (e.g., Web-Servers, DB-Servers), allowing NSG rules to reference logical application groupings rather than explicit IP addresses.
Azure Bastion is a fully managed PaaS provisioned inside a VNet that enables secure RDP/SSH access to VMs over TLS (port 443) directly via browser, keeping VMs hidden from the public internet without public IPs.
Microsoft Sentinel is a cloud-native SIEM and SOAR platform that ingests security telemetry across clouds, detects anomalies using machine learning, and executes automated remediation playbooks via Azure Logic Apps.
Managed HSM provides a fully managed, single-tenant, high-availability cryptographic key store validated to FIPS 140-2 Level 3 with strict role-based access control and isolated security domains.
AZ-500 is valid for one year and must be renewed annually by completing a free online renewal assessment on Microsoft Learn before expiration.
AZ-500 certifies Cloud Security Engineers, Information Security Specialists, and Cyber Defense Analysts, with average US salaries ranging between $135,000 and $175,000.