Free AZ-500 practice test 2026: 20 questions without signup

Questions on the exam

about 50 — vendor indicates, no fixed count published

Time allowed

100 minutes format →

Passing score

700 of 1000 — vendor, checked September 4, 2026 detail →

500 practice test questions for Microsoft Azure Security Engineer AZ-500 (retired), grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min AZ-500 readiness check →

AZ-500 certification: requirements, cost and exam format → ·  AZ-500 exam format →  ·  AZ-500 passing score →

Questions by domain

• Manage security operations — 137 questions →
• Secure compute, storage, and databases — 132 questions →
• Manage identity and access — 126 questions →
• Secure networking — 105 questions →

Sample questions

Scheduled analytics rule with a KQL query that uses: Which analytics rule type should the analyst use?

1. Scheduled analytics rule with a KQL query that uses the 'project', 'summarize', and 'join' operators to correlate failure and success events within the defined time windows ✓

   Scheduled analytics rules run KQL queries on a defined schedule against Sentinel data. Multi-event correlation (failures then success within time windows) requires KQL join/union operations that cross-correlate events — this is the correct rule type for complex multi-step detection logic.
2. Near-real-time (NRT) analytics rule that thresholds the SigninLogs failure count, relying on its one-minute cadence to catch the repeated failures and then join the later successful sign-in event

   NRT rules run every minute on a 1-minute lookback window. A brute force success pattern requires correlating events across a 10-minute window and joining two event types (failures and success). NRT rules have limited KQL complexity support and a short time window, so scheduled rules are more appropriate for this correlation.
3. Fusion analytics rule that correlates signals from multiple Defender products, letting its built-in engine assemble the failure-then-success brute force sequence for the account automatically

   Fusion rules are pre-built multi-stage attack detection rules that correlate signals from Microsoft security products using Microsoft's proprietary correlation engine. They are not user-configurable for the custom threshold or time-window logic that the described brute force pattern requires.
4. Anomaly analytics rule trained on historical sign-in baselines that learns the account's normal failure rate and raises an alert when a burst of failures deviates from it

   Anomaly analytics rules use built-in ML models to detect deviations from baseline behavior. They are not configurable for specific event count thresholds (10 failures in 5 minutes) or temporal correlation patterns. Scheduled KQL rules are required for deterministic threshold-based logic.

All 137 Manage security operations questions →

Enable Microsoft Defender for Azure SQL: What must they enable?

1. Enable Azure SQL Auditing and stream the audit logs to Log Analytics, where the built-in analytics rules raise the real-time SQL injection and anomalous query pattern security alerts for the database.

   SQL Auditing captures query events for compliance and forensics but performs no real-time threat analysis; Defender for Azure SQL provides the detection layer.
2. Enable the Defender for Cloud Enhanced Security Features toggle and set the database data sensitivity classification level to High, which turns on the SQL injection and anomaly threat alerts.

   Defender for Cloud uses individual per-resource plans, not one 'Enhanced Security' switch, and data sensitivity classification does not enable SQL threat alerts.
3. Enable Microsoft Defender for Servers on the virtual machines hosting the database application tier, so its agent inspects the SQL traffic and raises the injection and brute force alerts.

   Defender for Servers monitors OS-level threats on VMs, but Azure SQL Database is a managed PaaS service with no VM agent; Defender for Azure SQL is the right plan.
4. Enable Microsoft Defender for Azure SQL — this plan provides advanced threat protection including SQL injection detection, anomalous access patterns, and brute force alerts for Azure SQL databases ✓

   Microsoft Defender for Azure SQL is the specific plan that monitors Azure SQL Database for active threats. It detects SQL injection, anomalous query patterns, unusual access from unfamiliar locations, and brute force attempts. It is separate from CSPM and requires explicit enablement.

All 132 Secure compute, storage, and databases questions →

Create one user-assigned managed identity: Which managed identity configuration is most appropriate?

1. Create one user-assigned managed identity, grant it Key Vault Reader on the vault, and assign it to all 50 VMs ✓

   User-assigned managed identities are standalone resources that can be assigned to multiple compute resources. One identity with one RBAC assignment covers all 50 VMs — no per-VM identity management required.
2. Create a service principal with a client secret and distribute the secret to all 50 VMs via Key Vault

   Service principals with client secrets require secret rotation and distribution — managed identities eliminate credential management entirely and are the preferred pattern over service principal secrets.
3. Use a shared Azure AD group containing all 50 VM system-assigned identities and grant the group Key Vault Reader

   While grouping identities reduces RBAC assignments, each VM still needs a system-assigned identity enabled, creating 50 identity objects. User-assigned managed identity achieves the same result with a single identity object shared across all VMs.
4. Enable a system-assigned managed identity on each VM and grant each identity Key Vault Reader individually

   System-assigned identities are tied to the VM lifecycle — enabling 50 system-assigned identities requires 50 separate RBAC assignments, exactly what the question asks to avoid.

All 126 Manage identity and access questions →

The request is allowed because rule Priority 100 matches: What happens?

1. The request is allowed because rule Priority 100 matches first and allows TCP 443 from the 10.0.0.0/8 range, which includes 10.1.2.3 ✓

   NSG rules are evaluated in ascending priority order (lowest number = highest priority). Priority 100 matches 10.1.2.3 (which is in 10.0.0.0/8) on port 443 and allows the traffic. Once a rule matches, evaluation stops — Priority 200 is never reached.
2. The request is denied because the Priority 65500 default deny-all rule applies to any packet not matched earlier in the set.

   The default deny at 65500 is evaluated last; Priority 100 matches 10.1.2.3 and allows the traffic before that default rule is ever reached.
3. The traffic is allowed by Priority 100, then re-evaluated against Priority 200 on the response path, where the deny rule drops the reply.

   NSGs are stateful, so return traffic for an allowed inbound flow is permitted automatically without re-evaluating the rules on the response path.
4. The request is denied because Priority 200 explicitly denies TCP 443 from Any, and higher-numbered deny rules override the lower-numbered allow.

   Rules are evaluated in ascending priority order, so Priority 100 is processed first, matches the source, allows the traffic, and evaluation stops before 200.

All 105 Secure networking questions →

Create an automation rule in Sentinel that triggers: Which Sentinel feature enables this?

1. Configure a Scheduled analytics rule whose built-in automated response action directly calls a Key Vault secret update API to reset the user's password within seconds of the High-severity Account incident being created

   Analytics rules detect threats and create incidents — they do not perform remediation actions directly. Automated response is performed by playbooks (Logic Apps) triggered through automation rules. Also, resetting a password is not equivalent to disabling an account.
2. Create an automation rule in Sentinel that triggers on incident creation with condition 'Severity = High', then runs a playbook (Logic App) that calls the Microsoft Graph API to disable the user account in Entra ID ✓

   Automation rules evaluate incident conditions (severity, entity type, tactic) immediately when incidents are created and can trigger playbooks (Logic Apps) automatically. The playbook calls Microsoft Graph API to disable the account. This is a near-real-time automated response without analyst intervention.
3. Create a watchlist of compromised accounts in Sentinel and configure an analytics rule to tag matching users in incidents, then let Sentinel disable each tagged account whenever the incident severity is High

   Watchlists are reference data used to enrich KQL queries (for example, filtering against a list of known IPs). They do not tag users automatically or perform account actions. Automated response requires playbooks triggered by automation rules.
4. Enable the Sentinel SOAR feature and configure an Azure Automation runbook to poll for newly created High-severity incidents every minute and disable the affected Entra ID user accounts that it discovers

   Azure Automation runbooks with polling introduce latency and do not meet the 'within seconds' requirement. Sentinel automation rules with playbooks are event-driven (incident trigger) and execute within seconds of incident creation, so polling is both unnecessary and slower.

All 137 Manage security operations questions →

The developer loses all access: What happens to the developer's access after the switch?

1. The developer loses all access — vault access policies are not migrated to Azure RBAC assignments. New RBAC role assignments must be explicitly created to restore access ✓

   When a Key Vault is switched from vault access policy to Azure RBAC authorization mode, all existing vault access policies are retained in storage but are ignored — the RBAC engine takes over. No automatic migration of access policies to RBAC assignments occurs. The developer has no RBAC role assignment on the vault, so they have no access.
2. The developer retains access because switching to Azure RBAC automatically converts the existing 'Get' and 'List' access policy into an equivalent Key Vault Secrets User role assignment.

   No automatic conversion of access policies to RBAC assignments occurs; the two authorization systems are independent and require manual re-creation of equivalents.
3. The switch to Azure RBAC fails because all existing vault access policies must be manually deleted before the vault's authorization model can be changed.

   Existing access policies do not block the switch; they are preserved but become inactive while RBAC takes over, and can be re-examined if switched back.
4. The developer keeps 'Get' but loses 'List' access, because Azure RBAC maps the access policy 'Get' permission onto the built-in Key Vault Reader role during the authorization switch.

   There is no partial mapping of access policy permissions to RBAC roles; after the switch the developer has no role assignment and therefore no access at all.

All 132 Secure compute, storage, and databases questions →

Microsoft Entra External ID for B2B collaboration: Which Microsoft Entra feature should be used?

1. Microsoft Entra External ID for B2C — create a B2C tenant where partners self-register with social or local accounts

   B2C is designed for consumer-facing applications where end users self-register with social identities (Google, Facebook) or local accounts. It is not designed for partner enterprise access using existing corporate credentials.
2. Microsoft Entra External ID for B2B collaboration — invite partner users as guest accounts in the company's tenant ✓

   Entra B2B collaboration allows external users from partner organizations to authenticate with their home credentials (federated) and access resources as guest users in the inviting tenant. Invite-only model with no consumer self-registration.
3. Create a separate Azure AD tenant for each partner and establish tenant-to-tenant trust

   Separate tenants per partner is operationally prohibitive. B2B collaboration is specifically designed to federate with partner tenants without creating a separate tenant per partner.
4. Use cross-tenant synchronization to copy partner user objects into the company's tenant

   Cross-tenant synchronization copies user objects between tenants under the same organization — it is not designed for external partner access where partners maintain their own tenants independently.

All 126 Manage identity and access questions →

Deploy Azure Firewall Premium: Which Azure Firewall configuration is required?

1. Deploy Azure Firewall Basic with application rules for the HTTPS endpoints and enable threat intelligence in Alert mode to block the C2 traffic patterns.

   Azure Firewall Basic is a cost-optimized SKU without IDPS or TLS inspection, and Alert mode does not block; it cannot inspect encrypted payloads or stop C2.
2. Deploy Azure Firewall Premium, enable TLS inspection with a CA certificate stored in Key Vault, and configure the IDPS policy in Alert and Deny mode ✓

   Azure Firewall Premium is the only SKU that supports TLS inspection (decrypts HTTPS to inspect payload) and IDPS (Intrusion Detection and Prevention System). TLS inspection requires a CA certificate in Key Vault to sign re-encrypted traffic. IDPS in Alert and Deny mode blocks matching signatures including C2 patterns.
3. Deploy Azure Firewall Premium and enable DNS proxy, which decrypts the HTTPS sessions and applies the IDPS malware signatures to the payloads.

   DNS proxy routes DNS queries for FQDN filtering and does not decrypt HTTPS; TLS inspection is a separate feature requiring an explicit CA certificate.
4. Deploy Azure Firewall Standard, enable threat intelligence-based filtering, and configure FQDN rules to inspect the encrypted payload and block the C2 domains.

   Azure Firewall Standard supports threat intelligence filtering but not TLS inspection or IDPS, so it cannot inspect encrypted payload or detect behavioral C2 patterns.

All 105 Secure networking questions →

AZ-500 exam: the facts

How many questions are on the AZ-500 exam?

Around 50. The vendor does not publish a fixed count for AZ-500, so this is the figure it indicates rather than a guaranteed number.

How long is the AZ-500 exam?

100 minutes. Across 50 questions that is about 120 seconds per question.

What topics does the AZ-500 exam cover?

4 domains: Manage security operations, Secure compute, storage, and databases, Secure networking, Manage identity and access. Weights: Manage security operations 32.5%, Secure compute, storage, and databases 22.5%, Secure networking 22.5%, Manage identity and access 17.5%.

How many AZ-500 practice test questions does Certsqill have?

500, spread across 4 exam domains. Every one shows all options, which is correct, and why each of the others is not.