AZ-500 Cheat Sheet

#	Domain	Weight	Questions	Practice
1.0	Manage identity and access	9%	184	Practice →
2.0	Secure networking	24%	255	Practice →
Total	33%	1,073

Domain

Weight

Questions

Practice

1.0

Manage identity and access

184

Practice →

2.0

Secure networking

24%

255

Practice →

Total

33%

1,073

Domain Quick Reference

1.0Manage identity and access

Configure Microsoft Entra ID users, groups, external identities, MFA/passwordless methods, Conditional Access policies, and PIM role assignments. The critical skill is scoping Conditional Access and PIM eligibility so least privilege is enforced without locking out legitimate access.

Key concepts

✓Create and manage Entra ID users, groups, and dynamic membership rules
✓Configure authentication methods: MFA, passwordless FIDO2, and SSPR registration
✓Build Conditional Access policies with sign-in risk and device conditions
✓Govern privileged access using PIM, access reviews, and entitlement management

Watch out for

⚠Confusing Entra ID roles with Azure RBAC roles, then assigning the wrong scope or principal
⚠Forgetting that Conditional Access requires Entra ID P1 and excluding break-glass accounts
⚠Assuming PIM role activation is permanent rather than time-bound and requiring justification or approval

2.0Secure networking

You must configure NSGs, Azure Firewall, private endpoints, VNet peering, DDoS Protection, and Bastion to secure traffic. Get rule evaluation order right: NSG priority, Azure Firewall DNAT/network/application rules, and effective routes.

24%

Key concepts

✓Configuring NSG security rules, priorities, and application security groups for subnet traffic
✓Choosing Azure Firewall, NSG, or WAF for filtering and inspecting network flows
✓Implementing Private Link and private endpoints versus service endpoints for PaaS access
✓Securing remote administration with Azure Bastion, VPN Gateway, and Just-in-Time VM access

Watch out for

⚠Assuming service endpoints provide private IP connectivity; they only restrict access over the Azure backbone while traffic still uses public endpoints.
⚠Forgetting that NSG rules are stateful and that a lower-priority number wins, so deny rules can silently override intended allow rules.
⚠Believing Azure Firewall replaces NSGs; both are needed since NSGs filter at subnet/NIC level and Firewall handles centralized egress and FQDN filtering.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For AZ-500, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

#	Domain	Weight	Questions	Practice
1.0	Manage identity and access	9%	184	Practice →
2.0	Secure networking	24%	255	Practice →
Total	33%	1,073

Domain

Weight

Questions

Practice

1.0

Manage identity and access

184

Practice →

2.0

Secure networking

24%

255

Practice →

Total

33%

1,073

Domain Quick Reference

1.0Manage identity and access

Key concepts

✓Create and manage Entra ID users, groups, and dynamic membership rules
✓Configure authentication methods: MFA, passwordless FIDO2, and SSPR registration
✓Build Conditional Access policies with sign-in risk and device conditions
✓Govern privileged access using PIM, access reviews, and entitlement management

Watch out for

⚠Confusing Entra ID roles with Azure RBAC roles, then assigning the wrong scope or principal
⚠Forgetting that Conditional Access requires Entra ID P1 and excluding break-glass accounts
⚠Assuming PIM role activation is permanent rather than time-bound and requiring justification or approval

2.0Secure networking

24%

Key concepts

✓Configuring NSG security rules, priorities, and application security groups for subnet traffic
✓Choosing Azure Firewall, NSG, or WAF for filtering and inspecting network flows
✓Implementing Private Link and private endpoints versus service endpoints for PaaS access
✓Securing remote administration with Azure Bastion, VPN Gateway, and Just-in-Time VM access

Watch out for

⚠Assuming service endpoints provide private IP connectivity; they only restrict access over the Azure backbone while traffic still uses public endpoints.
⚠Forgetting that NSG rules are stateful and that a lower-priority number wins, so deny rules can silently override intended allow rules.
⚠Believing Azure Firewall replaces NSGs; both are needed since NSGs filter at subnet/NIC level and Firewall handles centralized egress and FQDN filtering.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For AZ-500, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

AZ-500 Exam Blueprint — At a Glance

Domain Quick Reference

1.0Manage identity and access

2.0Secure networking

Exam Day Reminders

More AZ-500 resources

AZ-500 Cheat Sheet

AZ-500 Exam Blueprint — At a Glance

Domain Quick Reference

1.0Manage identity and access

2.0Secure networking

Exam Day Reminders

More AZ-500 resources