Microsoft

Microsoft Azure Security Engineer (AZ-500)
exam objectives

Validates hands-on skill implementing, managing, and monitoring security for Azure, multi-cloud, and hybrid environments -- identity and access, networking, compute/storage/databases, and threat protection using Microsoft Defender for Cloud and Microsoft Sentinel.

Questions
60
Duration
100 min
Passing score
700
Domains
4

340 practice questions available for AZ-500 on CertPilot AI, mapped to the domains below.

AZ-500 exam domains and weightings

The AZ-500 exam is split into 4 domains. The percentage next to each is the share of the exam it accounts for — study time is best spent proportionally.

1.0Secure identity and access

18%

63 practice questions in this domain

  • 1.1Manage security controls for identity and access (built-in role assignments, custom roles, Microsoft Entra Privileged Identity Management, MFA, Conditional Access)
  • 1.2Manage Microsoft Entra application access and managed identities (enterprise app access, app registrations, permission scopes/consent, service principals, managed identities)

2.0Secure networking

23%

80 practice questions in this domain

  • 2.1Plan and implement security for virtual networks (NSGs/ASGs, Virtual Network Manager, UDRs, peering/VPN gateway, Virtual WAN, VPN connectivity, ExpressRoute encryption, firewall settings, Network Watcher)
  • 2.2Plan and implement security for private access to Azure resources (Service Endpoints, Private Endpoints, Private Link, App Service/Functions network integration, ASE and Azure SQL Managed Instance network security)
  • 2.3Plan and implement security for public access to Azure resources (TLS, Azure Firewall/Firewall Manager, Application Gateway, Front Door/CDN, WAF, DDoS Protection Standard)

3.0Secure compute, storage, and databases

24%

80 practice questions in this domain

  • 3.1Plan and implement advanced security for compute (VM remote access incl. Bastion/JIT, AKS network isolation/security/monitoring/auth, ACI/ACA monitoring, ACR access, disk encryption, API Management security)
  • 3.2Plan and implement security for storage (storage account access control and keys, Azure Files/Blob access methods, data threat protection incl. soft delete/backups/versioning/immutable storage, BYOK, double encryption)
  • 3.3Plan and implement security for Azure SQL Database and Azure SQL Managed Instance (Entra database authentication, auditing, dynamic masking, TDE, Always Encrypted)

4.0Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel

35%

117 practice questions in this domain

  • 4.1Implement and manage enforcement of cloud governance policies (Azure Policy, Key Vault network settings/access/RBAC, certificates/secrets/keys management and rotation, backup/recovery, asset management controls)
  • 4.2Manage security posture by using Microsoft Defender for Cloud (Secure Score/Inventory, compliance frameworks and standards, custom standards, hybrid/multi-cloud connection incl. AWS/GCP, Defender EASM)
  • 4.3Configure and manage threat protection by using Microsoft Defender for Cloud (cloud workload protection plans, Defender for Servers/Databases/Storage, agentless scanning, Defender Vulnerability Management, Defender for Cloud DevOps Security)
  • 4.4Configure and manage security monitoring and automation solutions (security alerts, workflow automation, Azure Monitor DCRs, Sentinel data connectors/analytics rules/automation)

How to prepare for Microsoft Azure Security Engineer

Most candidates fail AZ-500 not because they didn't know the material, but because they couldn't tell which material they were weakest on. Reading the objectives end to end treats every domain as equally important — the exam doesn't. On AZ-500, Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel alone is 35% of your score.

CertPilot AI works the other way around. It tracks your accuracy per domain, weights each domain by its real exam share, and pulls most of each practice session from wherever you're currently weakest. The result is a single readiness score — at 90% you're in the range where candidates typically pass, so you book the exam on evidence instead of a hunch.

Every question comes with an AI explanation of why the right answer is right and why each distractor is wrong. The Exam Decoder goes further and breaks down how to read a question — the qualifiers, the scenario framing, and the trap options — which is the skill that separates a 740 from a 700.

Microsoft Azure Security Engineer (AZ-500) FAQ

How many questions are on the Microsoft Azure Security Engineer (AZ-500) exam?

The AZ-500 exam has up to 60 questions and you get 100 minutes to complete it.

What score do you need to pass Microsoft Azure Security Engineer?

Microsoft Azure Security Engineer requires a scaled score of 700. Scaled scoring means the raw number of correct answers is adjusted for the difficulty of the specific question set you were served, so there is no fixed percentage that guarantees a pass.

What domains does the AZ-500 exam cover?

Microsoft Azure Security Engineer is divided into 4 domains: Secure identity and access (18%), Secure networking (23%), Secure compute, storage, and databases (24%), Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel (35%). The heaviest weighted domain is Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel at 35% of the exam.

How do I know when I'm ready to book the AZ-500 exam?

CertPilot AI calculates a readiness score by weighting your accuracy in each domain by that domain's share of the real exam, then scaling it by how many questions you've actually answered — so a domain you've barely touched can't inflate the number. At 90% you're in the range where candidates typically pass.

How much does the AZ-500 exam cost?

The Microsoft Azure Security Engineer exam voucher typically costs around $165 USD. Pricing varies by region and vendors periodically adjust it, so confirm on the official vendor site before booking.

Free to start

Start practising AZ-500 questions

Adaptive sessions weighted to the domains above, AI explanations on every question, and a readiness score that tells you when to book.

Start free

Other Microsoft certifications