Azure Mastery Exam AZ-500 Download
Azure Mastery

Microsoft Certification AZ-500

AZ-500: Predict your score. Know what to study next.

See your predicted score, follow a study plan based on your answers, and revisit topics you're starting to forget. It all runs on your device.

346 practice questions AI score prediction 100% offline
Download free iPhone & iPad · Free to start QR code — scan with your iPhone to open Azure Mastery on the App Store On your Mac?
Scan to install

AZ-500 Retired Exam Practice & Next Steps — Microsoft Azure Security Engineer

AZ-500 (Microsoft Azure Security Engineer) closed to new bookings on 31 August 2026, so Azure Mastery now runs its AZ-500 bank as a revision tool rather than exam prep — still with readiness scoring across all four domains. If you're starting fresh, go straight to the SC-500 successor instead. Every retired Microsoft exam and its replacement are on the retired exams hub.

The exam

What is the AZ-500 exam?

AZ-500 is the Microsoft Certified: Azure Security Engineer Associate exam — the credential hiring managers expect when posting "Cloud Security Engineer", "Azure Security Specialist", or "Cloud Security Operations" roles. It's the natural next step after AZ-104 for anyone administering Azure environments who's now responsible for the security posture of those environments. It also pairs with SC-900 on the way up to the SC-100 Cybersecurity Architect Expert credential.

AZ-500 is hands-on and operational. It validates that you can manage identity and access (Microsoft Entra ID, Conditional Access, PIM, application access); secure networking (NSGs, Azure Firewall, DDoS Protection, Private Link); secure compute, storage, and databases (encryption, key management, Defender plans for SQL / Storage / Containers); and run a live security operation using Microsoft Defender for Cloud and Microsoft Sentinel — including KQL queries, analytics rules, and incident triage. Expect scenario questions that show you a config snippet or attack signal and ask what you'd do next.

Microsoft updated the AZ-500 skills outline on 22 January 2026. Every question in Azure Mastery's AZ-500 bank is mapped to the current outline — no leftover questions on retired services. Read the official outline at learn.microsoft.com.

Microsoft retired AZ-500 on 31 August 2026 and folded the role into SC-500: Cloud and AI Security Engineer Associate. New candidates can no longer earn the Azure Security Engineer Associate credential, though anyone who already holds it keeps it. If you're planning the cloud and AI security route today, start with SC-500.

Skills measured · January 2026

AZ-500 exam objectives

Four domains, with weights set by Microsoft's January 2026 update. Every domain summary below is paraphrased from the official skills outline; Azure Mastery tags questions by exam objective, so you can see which domains need more practice.

Aura presents a visual map of identity, compute, networking, and Azure operations skills.
Azure skill map

Secure identity and access15–20%

Explore key topics

The Microsoft Entra surface end-to-end. Cover identity types (members, guests, hybrid identities), authentication (passwordless, MFA, password protection), Conditional Access design (named locations, sign-in risk, session controls), Privileged Identity Management (just-in-time activation, access reviews, eligibility), and Microsoft Entra ID Protection (risky users, risky sign-ins). Plus securing access to Azure resources via RBAC, Azure ABAC, custom roles, and managed identities. Around 6–12 questions per sitting.

Secure networking20–25%

Explore key topics

Defence-in-depth at the network layer. Configure perimeter security with Azure Firewall (rules, threat intelligence, hierarchies via Firewall Manager), Azure DDoS Protection, Web Application Firewall on Application Gateway and Front Door. Network segmentation with NSGs, application security groups, service tags. Private connectivity via Private Link, Private Endpoints, and service endpoints. Plus Azure Bastion, JIT VM access, ExpressRoute and VPN security. Around 8–15 questions.

Secure compute, storage, and databases20–25%

Explore key topics

Harden the workload tier. Compute: VM updates and disk encryption (host encryption, ADE, customer-managed keys), Azure Kubernetes Service security (network policies, Microsoft Entra integration, secrets), App Service network restrictions and authentication, container registry signing and scanning. Storage: SAS tokens, stored access policies, customer-managed keys, immutable storage. Databases: SQL TDE, Always Encrypted, dynamic data masking, Microsoft Defender for SQL. Plus Azure Key Vault as the cross-cutting story — keys, secrets, certificates, access policies vs RBAC. Around 8–15 questions.

Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel30–35%

Explore key topics

The largest domain by weight, and the operational core of the role. Microsoft Defender for Cloud: Secure Score, regulatory compliance (Azure Security Benchmark, custom standards), workload protection plans (Servers, App Service, Storage, SQL, Containers), security recommendations and exemptions, and the Cloud Security Posture Management surface. Microsoft Sentinel: data connectors (Azure activity, Microsoft 365, Defender XDR), analytics rules and watchlists, incident investigation, hunting with KQL, automation via playbooks (Logic Apps), workbooks. Plus security alert lifecycle and Defender for Cloud → Sentinel integration. Around 12–20 questions.

Designed for AZ-500

How Azure Mastery helps you pass AZ-500

Exam-specific practice

  • 346 AZ-500 practice questions aligned to the published skills outline.
  • Coverage follows the official four domains (identity and access, networking, compute/storage/databases, Defender for Cloud + Sentinel).
  • Practise decisions from the exam outline with scenarios and interactive questions.

Predicted score

  • Exam IQ predicts your AZ-500 score on-device after roughly 30 questions.
  • A confidence range shows how stable the prediction is.
  • See which exam objectives need the most work.

Adaptive study plan

  • Your study plan updates as you answer questions.
  • Missed topics return sooner; consistently mastered topics appear less often.
  • Sessions focus on the gaps most likely to help you reach the 700 pass score.

Knowledge decay

  • Track which topics you're starting to forget.
  • Get reminders to revisit those topics before exam day.
  • Weak-spot sessions bring fading topics back into practice.

Exam rehearsal

  • Practise staying focused through a full 100-minute session.
  • Original questions follow the published domain weighting.
  • Microsoft controls the live interface and exact question mix.

Answer Coach

  • Every answer has a written explanation, with reasons for individual options where available.
  • See why you missed an answer, how the options differ, and what to remember.
  • On supported devices, optional AI can reword notes while checking them against the written explanations.

Aura guidance

  • Aura suggests what to do after each session.
  • Recaps show your progress and which topics to practise next.

Private by design

  • Practice, scoring, readiness, and coaching run on-device.
  • You don't need an Azure Mastery account or a server to process your study data.
  • Optional sync uses your private iCloud account.

6-week study plan

Suggested AZ-500 study plan

Use this six-week plan as a reference to the retained AZ-500 content. Review the retirement notice and the SC-500 route before making exam plans.

  1. Identity and authentication

    • Compare Entra identity types and authentication methods.
    • Review password protection, MFA and passwordless access.
    • Design Conditional Access rules and session controls.

  2. Privileged and application access

    • Review PIM eligibility, activation and access reviews.
    • Investigate risky users and sign-ins with ID Protection.
    • Explore enterprise apps, app registrations and Application Proxy.

  3. Roles and segmentation

    • Compare RBAC, custom roles, ABAC and managed identities.
    • Use NSGs, ASGs and service tags.
    • Review Bastion and just-in-time VM access.

  4. Network protection

    • Review Azure Firewall rules and Firewall Manager.
    • Compare DDoS Protection and WAF on Application Gateway or Front Door.
    • Distinguish Private Link, private endpoints and service endpoints.

  5. Compute hardening

    • Plan VM updates.
    • Compare host encryption, Azure Disk Encryption and customer-managed keys.
    • Review AKS networking, identity and secrets.

  6. Application and container security

    • Secure App Service networking, authentication and TLS.
    • Review registry signing and scanning.
    • Explore Container Apps and Container Instances security.

  7. Storage and database security

    • Review SAS, stored access policies and immutable storage.
    • Compare encryption and customer-managed keys.
    • Review SQL encryption, masking and Defender for SQL.

  8. Key Vault

    • Manage keys, secrets and certificates.
    • Compare access policies with RBAC.
    • Review soft delete, purge protection and workload integration.

  9. Defender for Cloud

    • Review Secure Score and regulatory compliance.
    • Compare workload protection plans.
    • Explore recommendations, exemptions and just-in-time access.

  10. Microsoft Sentinel

    • Configure connectors, analytics rules and watchlists.
    • Practise KQL hunting and incident investigation.
    • Review playbooks and workbooks.

  11. Target weaker topics

    • Run Focus Weak Spots sessions.
    • Revisit Defender and Sentinel scenarios.
    • Review the reasoning behind missed answers.

  12. Review and move forward

    • Use retained simulator sessions for historical practice.
    • Review mistakes and remaining knowledge gaps.
    • Compare the SC-500 route before making exam plans.

Inside the app

Nine interactive practice formats, on iPhone

Azure Mastery has nine interactive formats for exam practice. The examples below show original AZ-500 practice questions in Azure Mastery on iPhone and iPad. The exam simulator uses timed sessions with the published domain weights. Microsoft's live interface and question mix may differ.

Which NSG rule property determines the order in which rules are evaluated?

  • Rule name
  • Direction
  • Priority
  • Protocol

Multiple choice

An original AZ-500 practice question with one correct answer. The app explains every option after you answer.

Exam-specific sample

Which THREE alert severity levels does Microsoft Defender for Cloud use? Select THREE.

  • Critical
  • High
  • Medium
  • Low
  • Informational
  • Warning

Multi-select

An original AZ-500 multi-select question. Select all the correct options to earn the mark.

All-or-nothing

Drag-and-drop

An original AZ-500 ordering question you can answer by touch on iPhone and iPad.

Interactive item

Hotspot

An original AZ-500 question with a visual prompt, designed for touch on iPhone and iPad.

Tap target

Case studies

An original AZ-500 case study with several questions about the same requirements and environment.

Multi-question

Answer Coach

Answer Coach explains why the answer is correct and, where available, why each option is right or wrong. It helps you understand a mistake and remember the distinction. Read explanations after each question or at the end of a practice test. On supported devices, optional AI can reword a note on your device after checking it against the written guidance.

App exclusive

Frequently asked

AZ-500 FAQs

How much does the AZ-500 exam cost?

The AZ-500 voucher was USD $165 in the United States, with regional pricing — moot now, since Microsoft retired the exam on 31 August 2026 and Pearson VUE won't book it. Sit SC-500 instead; it's the current Cloud and AI Security Engineer exam.

Does the AZ-500 certification expire?

AZ-500 and the Azure Security Engineer Associate certification retired on 31 August 2026. Microsoft states that renewal assessments are no longer available after a certification retires; already-earned Azure Security Engineer Associate credentials remain valid on your transcript. If you are starting now, prepare for SC-500 instead.

What is the AZ-500 retake policy if I fail?

The first retake is allowed after 24 hours. Second and third retakes each require a 14-day wait. Microsoft caps retakes at five attempts per 12-month rolling period. Each attempt requires a new voucher purchase.

How long should I study for AZ-500?

Since AZ-500 is no longer bookable, put the study time into SC-500, its current successor. SC-500 keeps AZ-500's identity and access, platform protection, and security operations core and adds cloud and AI workload security, so the same hands-on ground still applies: Entra, Defender for Cloud, Sentinel, Key Vault, Azure networking, and workload protection.

AZ-500 vs AZ-104 — should I do AZ-104 first?

Microsoft strongly recommends AZ-104 first, and it shows. AZ-500 assumes you already know how Azure compute, networking, and storage work day-to-day — it's the security overlay on top of that knowledge. If you've never deployed a VM or configured a VNet outside of fundamentals, take AZ-104 (Microsoft Azure Administrator) first; you'll save weeks on AZ-500 prep. If you have a year or more of hands-on Azure ops, you can skip AZ-104 and go straight in. Some employers want both anyway.

AZ-500 vs SC-200 — which next on the security track?

Different roles. AZ-500 is the Azure Security Engineer cert — it's about hardening Azure resources end-to-end. SC-200 is the Security Operations Analyst cert — it's about running Microsoft Defender XDR and Sentinel as a SOC analyst, with much heavier focus on M365 and incident triage workflows. If your day job is securing Azure workloads, AZ-500. If it's running detection-and-response across the Microsoft estate, SC-200. Many Cybersecurity Architect Expert candidates hold both, with SC-900 as the connective fundamentals.

Is Azure Mastery free for AZ-500 prep?

The app is free to download and includes a free allowance of AZ-500 questions so you can try every feature. The full bank of 346 AZ-500 practice questions unlocks with a one-time exam-pack purchase, or you can unlock every exam in the catalogue with a subscription or a one-time lifetime upgrade.

Does AZ-500 practice work offline?

Yes. Question practice, scoring, and the readiness prediction all run on-device, so you can study on a flight or a commute with no connection. No account is required, and your study data stays on your device with optional private iCloud sync.

Is there an AZ-500 practice test mode?

Yes — timed practice sessions use original, blueprint-aligned questions, published timing guidance, and supported interactive item types. Adaptive study sessions and Focus Weak Spots then target the domains where your accuracy is lowest.

Free study guides

Free guides that pair with AZ-500

Where AZ-500 fits

Certification paths that include AZ-500

AZ-500 is the Azure-specific security Associate cert. It pairs with SC-900 on the way into security work, and feeds into the SC-100 Cybersecurity Architect Expert credential alongside SC-200 / SC-300. Tap any linked exam below to see its dedicated study app page.

Cybersecurity Architect Expert path

Expert tier
  1. SC-900 Fundamentals (optional)
  2. AZ-500 prereq option
  3. or SC-200 prereq option
  4. SC-100 Cybersecurity Architect exam
  5. Cybersecurity Architect Expert credential

Ready to pass AZ-500?

Download Azure Mastery free. 346 AZ-500 practice questions across all four domains, AI score prediction, full-length exam simulator, adaptive study plan. iPhone & iPad.

Download Azure Mastery — free iPhone & iPad · Free to start · No account required
AZ-500 reference bank — free on the App Store Download