AZ-500 practice examsRetired by the vendor
Microsoft Azure Security Engineer
RETIRED 31 August 2026 - superseded by SC-500 (Cloud and AI Security Engineer Associate). Retained for reference: Implement security controls and threat protection, manage identity and access, and protect data, applications, and networks in cloud and hybrid environments as part of an end-to-end infrastructure.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Secure identity and access | 15-20% |
| Secure networking | 20-25% |
| Secure compute, storage, and databases | 20-25% |
| Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel | 30-35% |
Two sample questions
1. What is a DNAT rule in Azure Firewall?
- A data encryption rule which handles this scenario by applying the appropriate controls at the correct scope and permission level
- A Destination Network Address Translation rule that forwards inbound traffic from a public IP/port to a private IP/port behind the firewall — correct
- A rule that blocks all incoming traffic as this addresses the specific requirements while maintaining the proper security posture for the environment
- A DNS filtering rule since this option provides the necessary functionality and integrates with the existing infrastructure setup
Why: DNAT rules in Azure Firewall translate and redirect inbound traffic from the firewall's public IP and port to a private IP and port within the VNet. This allows external access to internal services while keeping them behind the firewall.
2. You accidentally deleted a secret from Azure Key Vault that is needed for production. Key Vault has soft delete enabled with a 90-day retention period. How do you recover the secret?
- Restore the secret from the last Azure Key Vault backup that was automatically created before deletion
- Recreate the secret with the same name and the original value since Key Vault tracks secret version history
- Recover the soft-deleted secret from the Key Vault using the Azure portal or CLI before the retention period expires — correct
- Contact Microsoft support to recover the secret from the platform-level backup within 48 business hours
Why: With soft delete enabled, deleted secrets are retained for the configured retention period (7-90 days). You can recover a soft-deleted secret using the Azure portal, CLI, or PowerShell before the retention period expires.
The real AZ-500 exam
| Length | 120 minutes |
|---|---|
| Questions | 40-60 |
| Pass mark | 700/1000 |
| Price | $165 USD |
| Recommended before you sit it | Strong understanding of Azure administration, networking, compute, and storage. Experience with scripting, Azure security services, and identity management. |
| Valid for | 1 year (annual renewal required) |
Exam facts as published by Microsoft; always check the vendor’s page before you book.
Study AZ-500 with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.