Microsoft Azure Security Technologies (AZ-500) Practice Exam
Microsoft Azure Security Technologies (AZ-500) Practice Exam
About Microsoft Azure Security Technologies (AZ-500)
The Microsoft Azure Security Technologies (AZ-500) exam is suitable for Azure Security Engineers who serve as part of a larger team dedicated to cloud-based management and security and may also secure or hybrid environments as part of an end-to-end infrastructure. Responsibilities for an Azure Security Engineer include maintaining the security posture, identifying and remediating vulnerabilities by using a variety of security tools, implementing threat protection, and responding to security incident escalations.
Who should take the exam?
Candidates for this exam should have subject matter expertise in implementing security controls and threat protection, managing identity and access, and protecting data, applications, and networks in cloud and hybrid environments as part of an end-to-end infrastructure.
Skills Required
A candidate for this exam should be familiar with scripting and automation and should have a deep understanding of networking and virtualization. A candidate should also have a strong familiarity with cloud capabilities, Azure products and services, and other Microsoft products and service
Course Outline
The Microsoft Azure Security Technologies (AZ-500) covers the latest topics as per exam updates -
Domain 1 - Secure identity and access (15–20%)
1.1 Manage security controls for identity and access
- Manage Azure built-in role assignments
- Manage custom roles, including Azure roles and Microsoft Entra roles
- Plan and manage Azure resources in Microsoft Entra Privileged Identity Management, including settings and assignments
- Implement multi-factor authentication (MFA) for access to Azure resources
- Implement Conditional Access policies for cloud resources in Azure
1.2 Manage Microsoft Entra application access and managed identities
- Manage access to enterprise applications in Microsoft Entra ID, including OAuth permission grants
- Manage Microsoft Entra app registrations
- Configure app registration permission scopes
- Manage app registration permission consent
- Manage and use service principals
- Manage managed identities
Domain 2 - Understanding Secure Networking (20–25%)
2.1 Describe planning and implementing security for virtual networks
- Learn to plan and implement Network Security Groups (NSGs) and Application Security Groups (ASGs)
- Manage virtual networks by using Azure Virtual Network Manager
- Learn to plan and implement user-defined routes (UDRs)
- Learn to plan and implement Virtual Network peering or VPN gateway
- Learn to plan and implement Virtual WAN, including secured virtual hub
- Learn to secure VPN connectivity, including point-to-site and site-to-site
- Learn to implement encryption over ExpressRoute
- Learn to configure firewall settings on PaaS resources
- Learn to monitor network security by using Network Watcher, including NSG flow logging
2.2 Describe planning and implementing security for private access to Azure resources
- Learn to plan and implement virtual network Service Endpoints
- Learn to plan and implement Private Endpoints
- Learn to plan and implement Private Link services
- Learn to plan and implement network integration for Azure App Service and Azure Functions
- Learn to plan and implement network security configurations for an App Service Environment (ASE)
- Learn to plan and implement network security configurations for an Azure SQL Managed Instance
2.3 Describe planning and implementing security for public access to Azure resources
- Learn to plan and implement Transport Layer Security (TLS) to applications, including Azure App Service and API Management
- Learn to plan, implement, and manage an Azure Firewall, including Azure Firewall Manager and firewall policies
- Learn to plan and implement an Azure Application Gateway
- Learn to plan and implement an Azure Front Door, including Content Delivery Network (CDN)
- Learn to plan and implement a Web Application Firewall (WAF)
- Learn to recommend when to use Azure DDoS Protection Standard
Domain 3 - Understanding to Secure compute, storage, and databases (20–25%)
3.1 Describe the planning and implementing advanced security for compute
- Learn to plan and implement remote access to public endpoints, including Azure Bastion and just-in-time (JIT) virtual machine (VM) access
- Learn to configure network isolation for Azure Kubernetes Service (AKS)
- Learn to secure and monitor AKS
- Learn to configure authentication for AKS
- Learn to configure security monitoring for Azure Container Instances (ACIs)
- Learn to configure security monitoring for Azure Container Apps (ACAs)
- Learn to manage access to Azure Container Registry (ACR)
- Learn to configure disk encryption, including Azure Disk Encryption (ADE), encryption at host, and confidential disk encryption
- Learn to recommend security configurations for Azure API Management
3.2 Describe planning and implementing security for storage
- Learn to configure access control for storage accounts
- Learn to manage life cycle for storage account access keys
- Learn to select and configure an appropriate method for access to Azure Files
- Learn to select and configure an appropriate method for access to Azure Blob Storage
- Learn to select and configure appropriate methods for protecting against data security threats, including soft delete, backups, versioning, and immutable storage
- Learn to configure Bring your own key (BYOK)
- Learn to enable double encryption at the Azure Storage infrastructure level
3.3 Explain planning and implementing security for Azure SQL Database and Azure SQL Managed Instance
- Learn to enable Microsoft Entra database authentication
- Learn to enable database auditing
- Learn to plan and implement dynamic masking
- Learn to implement Transparent Data Encryption (TDE)
- Learn to recommend when to use Azure SQL Database Always Encrypted
Domain 4 - Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel (30–35%)
4.1 Implement and manage enforcement of cloud governance policies
- Create, assign, and interpret policies and initiatives in Azure Policy
- Configure Azure Key Vault network settings
- Configure access to Key Vault, including vault access policies and Azure Role Based Access Control
- Manage certificates, secrets, and keys
- Configure key rotation
- Perform backup and recovery of certificates, secrets, and keys
- Implement security controls to protect backups
- Implement security controls for asset management
4.2 Manage security posture by using Microsoft Defender for Cloud
- Identify and remediate security risks by using the Microsoft Defender for Cloud Secure Score and Inventory
- Assess compliance against security frameworks by using Microsoft Defender for Cloud
- Manage compliance standards in Microsoft Defender for Cloud
- Add custom standards to Microsoft Defender for Cloud
- Connect hybrid cloud and multi-cloud environments to Microsoft Defender for Cloud, including Amazon Web Services (AWS) and Google Cloud Platform (GCP)
- Implement and use Microsoft Defender External Attack Surface Management (EASM)
4.3 Configure and manage threat protection by using Microsoft Defender for Cloud
- Enable cloud workload protection plans in Microsoft Defender for Cloud
- Configure Microsoft Defender for Servers, Microsoft Defender for Databases, and Microsoft Defender for Storage
- Implement and manage agentless scanning for virtual machines in Microsoft Defender for Servers
- Implement and manage Microsoft Defender Vulnerability Management for Azure virtual machines
- Connect to and configure settings in Microsoft Defender for Cloud Devops Security, including GitHub, Azure DevOps, and GitLab
4.4 Configure and manage security monitoring and automation solutions
- Manage and respond to security alerts in Microsoft Defender for Cloud
- Configure workflow automation by using Microsoft Defender for Cloud
- Monitor network security events and performance data by configuring data collection rules (DCRs) in Azure Monitor
- Configure data connectors in Microsoft Sentinel
- Enable analytics rules in Microsoft Sentinel
- Configure automation in Microsoft Sentinel
What are our Practice Exams?
- Practice exams have been designed by professionals and domain experts that simulate real-time exam scenario.
- Practice exam questions have been created on the basis of content outlined in the official documentation.
- Each set in the practice exam contains unique questions built with the intent to provide real-time experience to the candidates as well as gain more confidence during exam preparation.
- Practice exams help to self-evaluate against the exam content and work towards building strength to clear the exam.
- You can also create your own practice exam based on your choice and preference
