AZ-500 practice questions: 500 with full explanations

500 practice questions for Microsoft Azure Security Engineer AZ-500 (retired), grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min AZ-500 readiness check →

AZ-500 exam format →  ·  AZ-500 passing score →

Questions by domain

• Manage security operations — 137 questions →
• Secure compute, storage, and databases — 132 questions →
• Manage identity and access — 126 questions →
• Secure networking — 105 questions →

Sample questions

Scheduled analytics rule with a KQL query that uses: Which analytics rule type should the analyst use?

1. Scheduled analytics rule with a KQL query that uses the 'project', 'summarize', and 'join' operators to correlate failure and success events within the defined time windows ✓

   Scheduled analytics rules run KQL queries on a defined schedule against Sentinel data. Multi-event correlation (failures then success within time windows) requires KQL join/union operations that cross-correlate events — this is the correct rule type for complex multi-step detection logic.
2. Near-real-time (NRT) analytics rule that thresholds the SigninLogs failure count, relying on its one-minute cadence to catch the repeated failures and then join the later successful sign-in event

   NRT rules run every minute on a 1-minute lookback window. A brute force success pattern requires correlating events across a 10-minute window and joining two event types (failures and success). NRT rules have limited KQL complexity support and a short time window, so scheduled rules are more appropriate for this correlation.
3. Fusion analytics rule that correlates signals from multiple Defender products, letting its built-in engine assemble the failure-then-success brute force sequence for the account automatically

   Fusion rules are pre-built multi-stage attack detection rules that correlate signals from Microsoft security products using Microsoft's proprietary correlation engine. They are not user-configurable for the custom threshold or time-window logic that the described brute force pattern requires.
4. Anomaly analytics rule trained on historical sign-in baselines that learns the account's normal failure rate and raises an alert when a burst of failures deviates from it

   Anomaly analytics rules use built-in ML models to detect deviations from baseline behavior. They are not configurable for specific event count thresholds (10 failures in 5 minutes) or temporal correlation patterns. Scheduled KQL rules are required for deterministic threshold-based logic.

All 137 Manage security operations questions →

Enable Microsoft Defender for Azure SQL: What must they enable?

1. Enable Azure SQL Auditing and stream the audit logs to Log Analytics, where the built-in analytics rules raise the real-time SQL injection and anomalous query pattern security alerts for the database.

   SQL Auditing captures query events for compliance and forensics but performs no real-time threat analysis; Defender for Azure SQL provides the detection layer.
2. Enable the Defender for Cloud Enhanced Security Features toggle and set the database data sensitivity classification level to High, which turns on the SQL injection and anomaly threat alerts.

   Defender for Cloud uses individual per-resource plans, not one 'Enhanced Security' switch, and data sensitivity classification does not enable SQL threat alerts.
3. Enable Microsoft Defender for Servers on the virtual machines hosting the database application tier, so its agent inspects the SQL traffic and raises the injection and brute force alerts.

   Defender for Servers monitors OS-level threats on VMs, but Azure SQL Database is a managed PaaS service with no VM agent; Defender for Azure SQL is the right plan.
4. Enable Microsoft Defender for Azure SQL — this plan provides advanced threat protection including SQL injection detection, anomalous access patterns, and brute force alerts for Azure SQL databases ✓

   Microsoft Defender for Azure SQL is the specific plan that monitors Azure SQL Database for active threats. It detects SQL injection, anomalous query patterns, unusual access from unfamiliar locations, and brute force attempts. It is separate from CSPM and requires explicit enablement.

All 132 Secure compute, storage, and databases questions →

Create one user-assigned managed identity: Which managed identity configuration is most appropriate?

1. Create one user-assigned managed identity, grant it Key Vault Reader on the vault, and assign it to all 50 VMs ✓

   User-assigned managed identities are standalone resources that can be assigned to multiple compute resources. One identity with one RBAC assignment covers all 50 VMs — no per-VM identity management required.
2. Create a service principal with a client secret and distribute the secret to all 50 VMs via Key Vault

   Service principals with client secrets require secret rotation and distribution — managed identities eliminate credential management entirely and are the preferred pattern over service principal secrets.
3. Use a shared Azure AD group containing all 50 VM system-assigned identities and grant the group Key Vault Reader

   While grouping identities reduces RBAC assignments, each VM still needs a system-assigned identity enabled, creating 50 identity objects. User-assigned managed identity achieves the same result with a single identity object shared across all VMs.
4. Enable a system-assigned managed identity on each VM and grant each identity Key Vault Reader individually

   System-assigned identities are tied to the VM lifecycle — enabling 50 system-assigned identities requires 50 separate RBAC assignments, exactly what the question asks to avoid.

All 126 Manage identity and access questions →