Microsoft · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
9% of exam · 6 sample questions below
Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage roles. You need to ensure that when a user activates a role, the activation is automatically approved only if the user's manager approves within 30 minutes. If the manager does not respond, the activation is denied. What configuration should you implement?
Enable just-in-time access for the role and configure a group approval with a 30-minute timeout.
Configure the role settings to require approval, set the maximum activation duration to 30 minutes, and add the user's manager as an approver.
This ensures the manager must approve within the activation window, or the request expires.
Create an approval workflow in Microsoft Entra ID that assigns the manager as the approver and set a timeout of 30 minutes.
Configure the role settings to require approval and set the approval timeout to 0 minutes.
Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access Exchange Online. The solution must require users to reauthenticate every 12 hours. What should you configure?
Create a Conditional Access policy that requires MFA for Exchange Online and set sign-in frequency to 12 hours.
Create a Conditional Access policy that grants access to Exchange Online only if the device is compliant, and set session sign-in frequency to 12 hours.
This enforces both device compliance and reauthentication frequency.
Create an app protection policy for Exchange Online that requires device compliance and sets sign-in frequency.
Configure a device compliance policy for all devices and enable 'Reauthenticate every 12 hours' in the compliance policy.
Your organization uses Microsoft Entra ID and has a hybrid identity with Microsoft Entra Connect. You need to ensure that all user password changes and resets are synchronized to the cloud within 30 minutes. Which TWO actions should you take? (Choose two.)
Configure federation with AD FS.
Set the Azure AD Connect synchronization frequency to 30 minutes.
Correct. Setting the synchronization frequency to 30 minutes ensures that password changes on-premises are replicated to the cloud within the required time.
Enable password writeback in Microsoft Entra Connect.
Enable Azure AD Connect Health to monitor synchronization.
Configure pass-through authentication for user sign-ins.
You are designing a privileged access strategy for Microsoft Entra ID. Your organization requires that all users who are assigned to the Global Administrator role must perform a privileged elevation only when needed, and the elevation must be approved by a security officer. Which feature should you implement?
Microsoft Entra Identity Governance – Privileged Identity Management
Microsoft Entra Privileged Identity Management (PIM) delivers just-in-time privileged access by letting users activate eligible role assignments for a maximum time window, with optional approval workflows, MFA, and business justification. Because activation is time-bound and audited, PIM directly supports a privileged access strategy that requires temporary elevation with oversight.
Azure AD administrative units
Conditional Access with session control
Microsoft Entra ID protection risk policies
Your organization uses Microsoft Entra ID for identity management. You need to ensure that users accessing sensitive data from unmanaged devices are required to use a compliant device. What should you configure?
Configure a device registration policy
Configure a Conditional Access policy that requires that the device be marked as compliant
This enforces device compliance for access to sensitive data.
Configure an Identity Protection policy for user risk
Configure a Conditional Access policy that requires multi-factor authentication
A company is implementing Privileged Identity Management (PIM) in Microsoft Entra ID for Azure resources. The security team wants to ensure that all privileged role activations require approval and are logged. They also want to require Azure MFA during activation. However, they notice that some users are able to activate roles without approval. What is the most likely cause?
Users have permanent eligible assignments that bypass approval
The audit log is not enabled for PIM
Users are assigned the role directly instead of through eligibility
The role settings for approval are not configured at the resource scope, and the users are using inherited settings from a management group
Role settings can be configured at different scopes (management group, subscription, resource group). If the approval requirement is not set at the specific scope, inherited settings may not require approval.
Want more Secure identity and access practice?
Practice this domain24% of exam · 6 sample questions below
A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is in the same region and has a system-assigned managed identity with the 'Key Vault Crypto Service Encryption User' role assigned at the key scope. However, TDE operations fail because the SQL server cannot access the Key Vault. What additional configuration is required to allow the SQL server to access the Key Vault for TDE operations?
Configure a private endpoint for the SQL server to the Key Vault.
Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault.
This setting allows trusted Azure services, including Azure SQL Database, to access the Key Vault even when the firewall is enabled. Since the SQL server's managed identity already has the cryptographic role, this is the missing piece to allow TDE operations.
Change the Key Vault firewall to allow all Azure services.
Create a VNet service endpoint for Microsoft.KeyVault on the SQL server's subnet.
A company stores sensitive files in Azure Files shares. They require encryption at rest using customer-managed keys (CMK) and encryption in transit using SMB 3.0 encryption. They have created a premium Azure Files share in a storage account and configured encryption at rest with a CMK. However, clients are able to connect without enforcing SMB encryption. What additional configuration is necessary to ensure that all connections to the file share are encrypted in transit?
Enable the 'Secure transfer required' property on the storage account.
Enabling the storage account's 'Secure transfer required' property rejects requests over unencrypted connections. For Azure Files, this forces clients to use SMB 3.0 with encryption (or HTTPS for REST), so sensitive data is encrypted while traversing the network. This is the proper, supported control for enforcing encryption in transit for Azure Files.
Configure a network security group (NSG) to allow only encrypted traffic.
Set the minimum SMB protocol version to 3.0 on the file share.
Create a service endpoint for the storage account.
A company uses Azure SQL Database with Transparent Data Encryption (TDE) and wants to use a customer-managed key (CMK) stored in Azure Key Vault. The security policy requires that the Key Vault be protected by a firewall and virtual network service endpoints to restrict network access. The storage account for TDE logs is in the same Azure region. Which additional configuration is necessary in the Key Vault to allow Azure SQL Database to access the CMK for encryption operations?
Add a network rule in the Key Vault firewall allowing the public IP range of the Azure SQL Database server.
Enable the 'Allow trusted Microsoft services to bypass this firewall' option in the Key Vault networking settings.
Enabling 'Allow trusted Microsoft services to bypass this firewall' is the correct solution because Azure SQL Database is a trusted Microsoft service and its managed identity can authenticate to the Key Vault using Azure AD, then fetch the encryption key for TDE. With this setting, the Key Vault firewall remains enabled for public internet traffic, but Azure services like SQL Database are permitted to bypass the IP restrictions. This is the intended pattern for TDE with customer-managed keys, as SQL Database runs outside your virtual network and its outbound IPs cannot be reliably scoped.
Create a private endpoint for the Key Vault and connect it to the same virtual network as the Azure SQL Database.
Configure the Key Vault to use role-based access control (RBAC) and assign the 'Key Vault Crypto Service Encryption User' role to the SQL Database server's managed identity.
A company uses Azure Disk Encryption (ADE) on Windows virtual machines. They use a key encryption key (KEK) stored in Azure Key Vault to wrap the disk encryption key. The security policy requires that the KEK be automatically rotated every 90 days. They need to ensure that after rotation, the OS and data disks of running VMs automatically get re-wrapped with the new KEK version. Which configuration should they implement?
Enable soft-delete and purge protection on the Key Vault.
Use Key Vault key auto-rotation with a 90-day rotation period, and configure the disk encryption set to use the latest key version (empty string).
Key Vault key auto-rotation creates new key versions on schedule. By setting the key version to empty in the disk encryption set, the VMs automatically re-wrap their disks with the latest key version after rotation.
Create a new KEK every 90 days and modify the disk encryption set to point to the new key version.
Use Azure Policy to enforce automatic key rotation.
A company uses Azure SQL Database with Transparent Data Encryption (TDE) using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server has a system-assigned managed identity assigned the 'Key Vault Crypto Service Encryption User' role. However, TDE operations are failing because the SQL server cannot access the Key Vault. What additional configuration is needed?
Enable the Key Vault firewall to allow trusted Microsoft services
Azure SQL Database TDE with customer-managed keys requires SQL to access Key Vault for key wrap and unwrap operations. The Key Vault firewall blocks public access, but the 'Allow trusted Microsoft services' exception lets Azure SQL's underlying service bypass the firewall for these cryptographic operations, using the SQL server's managed identity. This is the only network change needed while keeping public access blocked.
Create a private endpoint for the SQL server to access the Key Vault
Enable public network access on the Key Vault
Assign the SQL server's managed identity the 'Reader' role on the Key Vault
A company uses Azure SQL Database to store customer data, including credit card numbers. The security policy requires that database administrators (DBAs) must not be able to view the credit card numbers in plaintext. The column containing the credit card numbers must be encrypted at rest and in transit, and only a specific application (using a dedicated client library) should be able to decrypt the data. Which technology should they implement?
Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault.
Dynamic Data Masking (DDM) for the credit card column.
Always Encrypted with a client-side encryption key stored in Azure Key Vault.
Correct. Always Encrypted encrypts the data on the client side, so the SQL Database never sees the plaintext. Only the client application with access to the encryption key can decrypt the data, preventing DBAs from viewing sensitive columns.
Row-Level Security (RLS) to restrict DBA access to the credit card column.
Want more Secure compute, storage, and databases practice?
Practice this domain34% of exam · 6 sample questions below
Your company uses Microsoft Sentinel to correlate data from multiple sources. You need to create an analytics rule that triggers an incident when a user signs in from an unfamiliar location and then performs a high-risk action in Azure. What is the best approach?
Run a custom anomaly detection job
Create a Scheduled analytics rule with a KQL query
Create a Near-Real-Time (NRT) analytics rule
Create a Fusion analytics rule
Fusion rules correlate multiple alerts from different sources.
Refer to the exhibit. This is an excerpt from an Azure Policy assignment. What is the effect of the 'notScopes' property?
The policy will apply only to the VM-Sensitive virtual machine.
The policy will apply to all resources in RG-Prod except the entire resource group.
The policy will apply to all resources in RG-Prod except the VM-Sensitive virtual machine.
The assignment's scope is RG-Prod, making every contained resource subject to policy evaluation. The notScopes array specifies the VM-Sensitive virtual machine resource ID, so that VM alone is excluded from compliance evaluation. All other resources, regardless of type, remain within the assignment's scope and are evaluated.
The policy will apply to the subscription but not to RG-Prod.
Your organization uses Microsoft Defender for Cloud. You need to ensure that all Azure subscriptions have the 'Auto-provisioning' extension enabled for Log Analytics agent on new VMs. What should you configure?
Configure Azure Automation State Configuration to push the agent.
Set up data connectors in Microsoft Sentinel.
Enable 'Auto-provisioning' in Defender for Cloud's environment settings.
In Defender for Cloud's environment settings, enabling 'Auto-provisioning' deploys the Log Analytics agent extension automatically to new VMs without manual intervention. This satisfies the stem's requirement for a subscription-wide, automated mechanism that ensures all new VMs receive the agent, as opposed to per-VM manual installation or policy-based assignment.
Create an Azure Policy assignment to deploy the Log Analytics agent.
Your organization is using Microsoft Defender for Cloud to protect Azure SQL databases. You need to enable Advanced Threat Protection (ATP) for all existing and future Azure SQL databases in a subscription. The solution must minimize administrative effort. What should you do?
Configure Microsoft Sentinel to monitor Azure SQL databases.
Enable the Azure SQL databases plan in Microsoft Defender for Cloud at the subscription level.
Correct. Enabling the plan at the subscription level applies to all current and future resources.
Create an Azure Policy to deploy Advanced Threat Protection on Azure SQL databases.
Enable Advanced Threat Protection on each Azure SQL database individually.
Which TWO actions can be performed using Microsoft Defender for Cloud's security alerts? (Choose two.)
Directly modify the affected Azure resource's configuration from the alert.
Export alerts to a third-party SIEM using continuous export.
Change the severity of an alert after it is generated.
Create suppression rules to automatically dismiss alerts that meet specific criteria.
Suppression rules allow you to suppress alerts based on conditions.
Trigger a logic app playbook automatically when an alert is generated.
Playbooks can be triggered from alerts for automated response.
You are a security analyst using Microsoft Sentinel. You need to create an analytics rule that triggers an incident when more than 10 failed sign-ins occur from the same IP address within 5 minutes. The rule should use a KQL query. Which query should you use?
SigninLogs | where ResultType !in ("0","50125") // failed attempts | summarize Count = count() by IPAddress, bin(TimeGenerated, 5m) | where Count > 10
This query correctly groups failed sign-ins by IP and 5-minute bin, and filters for >10.
SigninLogs | where ResultType != "0" | make-series Count=count() default=0 on TimeGenerated from ago(5m) to now() step 5m by IPAddress
SigninLogs | where ResultType == "0" | summarize Count = count() by IPAddress, bin(TimeGenerated, 5m) | where Count > 10
SigninLogs | where ResultType == "0" | summarize Count = count() by IPAddress, bin(time-generated, 5m) | where Count > 10
Want more Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel practice?
Practice this domain9% of exam · 6 sample questions below
A company uses Azure AD Identity Protection. They want to automatically block sign-ins that have a high user risk level, but only for users in the 'Finance' department. They also want to require MFA for medium user risk level for all users (including Finance) when sign-in risk is not blocked. They have already created a Conditional Access policy for the Finance department that has a condition of 'User risk level: High' and a grant control of 'Block access'. What additional configuration is needed to also require MFA for all users with medium user risk?
Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'
A separate policy for medium user risk applied to all users will require MFA when medium risk is detected. The existing policy will continue to block Finance users with high risk. Policy evaluation is not mutually exclusive; the block takes precedence for high risk, and the MFA requirement applies for medium risk.
Modify the existing policy to include 'User risk level: Medium' and change the grant control to 'Require multi-factor authentication'
Use Identity Protection's 'User risk policy' instead of Conditional Access
Create a new Conditional Access policy with condition 'User risk level: Medium' and grant control 'Block access'
A company uses Azure AD Privileged Identity Management (PIM) to manage the Global Administrator role. They want to require that when a user activates the role, they must be using a device that is compliant with Intune policies (e.g., compliant device) and must provide a justification. The company already has Conditional Access policies in place for regular access. How should they enforce the device compliance requirement specifically during PIM activation?
Configure a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' cloud app, requiring compliant device.
In PIM settings for the Global Administrator role, enable 'Require Multi-Factor Authentication on activation'.
In PIM settings for the Global Administrator role, enable 'Require Azure AD Conditional Access authentication context' and create a Conditional Access policy that requires compliant device when that authentication context is used.
This is the correct approach because PIM supports emitting an Azure AD Conditional Access authentication context during role activation. When you enable 'Require Azure AD Conditional Access authentication context' in PIM settings, Azure AD sends that context as a signal to Conditional Access for the activation request. A separate Conditional Access policy can then target that authentication context and apply the 'Require device to be marked as compliant' grant control. This is the documented integration pattern for combining PIM with device-compliance policies, and it satisfies the requirement without relying on unsupported targets like the PIM app itself.
Use Azure AD Identity Protection's user risk policy to require device compliance when a high-risk user activates the role.
A company has an on-premises web application that they want to expose to external users over the internet without requiring a VPN. External users must authenticate with Modern Authentication (e.g., using Azure Multi-Factor Authentication) and access policies must be enforced via Conditional Access. The application does not support SAML or OAuth. Which Azure service should they use to publish this application securely?
Azure AD B2C (Business-to-Consumer).
Azure Application Gateway with Web Application Firewall (WAF).
Azure AD Application Proxy.
Azure AD Application Proxy is the appropriate service here because it is purpose-built to publish on-premises HTTP/HTTPS apps to external users through Azure AD. A lightweight connector installed on the corporate network establishes an outbound connection to the Azure AD Application Proxy service, eliminating the need for inbound firewall ports or a VPN; the external endpoint is an Azure AD URL that performs full Azure AD pre-authentication, including MFA and Conditional Access, before passing the authenticated request back through the connector to the internal web application. It effectively acts as an HTTPS reverse proxy bridged by an outbound-only tunnel, which is exactly what is required to securely expose an on-premises web app without making it publicly reachable.
Azure Front Door.
A company uses Azure AD Identity Protection and Conditional Access. A user is detected with a 'High' user risk level due to suspicious activity. The security team wants to automatically block sign-ins for this user, but only when the sign-in originates from a location that is not in the company's list of trusted IPs. They have created a Conditional Access policy targeting all users. Which configuration should they add to the policy to achieve this?
Add a condition for 'User risk' set to 'High', and a condition for 'Sign-in risk' set to 'High', then grant 'Block access'.
Add a condition for 'User risk' set to 'High' and exclude 'All trusted locations' under the 'Locations' condition, then grant 'Block access'.
This is correct because it combines the specific condition—User risk High—with a location exclusion for all trusted IP ranges, ensuring the block only applies to sign-ins that originate from untrusted locations. Conditional Access evaluates the user risk condition and the location condition together, and with the grant control set to Block access, any matching sign-in is denied. This matches the requirement precisely: only high user risk accounts attempting sign-in from outside the corporate network are blocked.
Add a condition for 'User risk' set to 'High', and under 'Grant', select 'Require multi-factor authentication' and 'Block access'.
Add a condition for 'Locations' set to 'Any location' and under 'Grant', select 'Block access' for all users.
A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. The security policy requires that when a user activates the Security Administrator role, they must: 1) Provide a justification, 2) Get approval from a designated security group, and 3) The activation must last a maximum of 4 hours. Which combination of PIM settings should they configure?
Enable 'Require justification', 'Require approval', and set 'Maximum activation duration' to 4 hours. Assign the security group as the approver.
This meets all three requirements: justification is required, approval from the security group is required, and the activation duration is limited to 4 hours.
Enable 'Require justification', 'Require ticket information', and set 'Maximum activation duration' to 8 hours.
Enable 'Require approval' and set 'Maximum activation duration' to 4 hours. Do not require justification.
Enable 'Require Azure MFA on activation', 'Require justification', and set 'Maximum activation duration' to 4 hours.
A company uses Azure AD Privileged Identity Management (PIM) to manage access to critical roles. They want to require that users who are eligible for the 'Security Administrator' role must provide a support ticket number in the justification when activating the role. Additionally, they want to set a maximum activation duration of 4 hours. Which PIM role setting should they configure?
Activation settings
In the activation settings for the role, you can set maximum duration (4 hours) and require justification with a ticket number field.
Notification settings
Approval settings
Assignment settings
Want more Manage identity and access practice?
Practice this domainYour company has an Azure subscription with a hub-spoke network topology. The hub contains an Azure Firewall and a VPN gateway for on-premises connectivity. The spoke virtual network hosts a critical application. You need to ensure that all outbound traffic from the spoke to the internet and on-premises networks flows through the Azure Firewall. You configure a user-defined route (UDR) on the spoke subnet with the default route (0.0.0.0/0) pointing to the Azure Firewall private IP. However, traffic to on-premises still bypasses the firewall. What is the most likely cause?
The on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the UDR
BGP-learned routes for on-premises networks are more specific than 0.0.0.0/0. They will be used even if a UDR for 0.0.0.0/0 exists. To force through firewall, you must either disable BGP route propagation or create specific UDRs for on-premises ranges.
The UDR must be applied to the subnet that hosts the Azure Firewall
The spoke subnet does not have 'GatewaySubnet' route propagation enabled
The Azure Firewall is not configured with a route to the on-premises network
A company has a hub-spoke network topology with Azure Firewall deployed in the hub virtual network. Spoke virtual networks are peered to the hub. The security team needs to ensure that all outbound internet traffic from virtual machines in a spoke subnet goes through the Azure Firewall. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP address. However, traffic from spoke VMs is still bypassing the firewall and going directly to the internet. What is the most likely reason?
The route table is not associated with the spoke subnet.
A route table only takes effect when it is explicitly associated with a subnet. In this hub-spoke topology, the spoke subnet still has the default system routes, so traffic destined for the internet follows the default route and bypasses Azure Firewall. You must associate the custom route table—with a UDR that uses the firewall's private IP as the next hop and next hop type 'VirtualAppliance'—to the spoke subnet for forced tunneling to work.
Azure Firewall is not configured with DNAT rules for outbound traffic.
The spoke VNet peering does not allow gateway transit.
The route table has a higher priority than system routes.
A company has two Azure virtual networks, VNet-A (hub) and VNet-B (spoke), connected via VNet peering. They deploy a network virtual appliance (NVA) in a subnet in VNet-A to inspect all traffic between the VNets. They configure a user-defined route (UDR) on the subnet in VNet-B with the destination address space of VNet-A (10.0.0.0/16) and the next hop set to the private IP of the NVA. However, traffic from VNet-B to VNet-A still bypasses the NVA and takes a direct path. What is the most likely cause?
The NVA's private IP address is not reachable from VNet-B
VNet peering system routes override user-defined routes
The UDR must be applied to the gateway subnet of VNet-B
The NVA network interface does not have IP forwarding enabled
IP forwarding must be enabled on the NVA's NIC for it to forward traffic destined to other IPs. Without it, the NVA will drop the traffic, and the peering path remains active.
A company has two Azure virtual networks, VNet-A and VNet-B, connected via VNet peering. They want all traffic between the VNets to be inspected by a network virtual appliance (NVA) deployed in a subnet in VNet-A. They have configured a user-defined route (UDR) on the subnet in VNet-B that points the destination address space of VNet-A to the private IP of the NVA. However, traffic between the VNets is still not passing through the NVA. What is the most likely cause?
The UDR is not associated with the subnet in VNet-B.
The NVA's network interface (NIC) does not have IP forwarding enabled.
IP forwarding must be explicitly enabled on the network interface (NIC) of the NVA before Azure will deliver packets whose destination IP is not assigned to that NIC. Without it, the Azure fabric drops packets that are addressed to other IPs, so even if the NVA's operating system is configured to route traffic, the packets never reach it. This is the most common omission when deploying NVAs with UDRs, and it precisely explains why traffic flows end-to-end via peering but not through the NVA — the NVA silently discards (or never receives) the forwarded packets.
The VNet peering connection is not in a 'Connected' state.
The NVA is deployed in the same subnet as the source VMs.
A company has two Azure virtual networks (VNet-A and VNet-B) connected via VNet peering. They need to ensure that all traffic between the two VNets is encrypted using IPsec and that no traffic can bypass the encryption. The security team has enabled the 'Use remote virtual network gateways' setting on the peering. However, traffic is still flowing unencrypted. What additional configuration is required to enforce encryption for all traffic between the VNets?
Enable 'Azure virtual network encryption' on both VNets and configure the encryption policy.
Azure virtual network encryption (currently in preview) encrypts all traffic between VNets using IPsec. Enabling it on both sides ensures traffic is encrypted.
Deploy an Azure VPN Gateway in each VNet and create a site-to-site VPN connection between them.
Configure a network security group (NSG) rule on each subnet to deny traffic that is not IPsec encapsulated.
Enable 'Allow gateway transit' on VNet-A and 'Use remote virtual network gateways' on VNet-B, and then create a VPN gateway in VNet-A.
A company is designing a hub-spoke network topology with Azure Firewall in the hub virtual network. Spoke virtual networks are peered to the hub. They want to ensure that all outbound internet traffic from virtual machines in a spoke subnet goes through the Azure Firewall. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP address as the next hop. However, traffic is still bypassing the firewall. What is the most likely cause?
The Azure Firewall is in a different region than the spoke VNet.
The route table is not associated to the spoke subnet.
A user-defined route table only takes effect when it is explicitly associated with a subnet; simply creating a route table and adding a route to the firewall's private IP does nothing otherwise. Without that association, the subnet uses Azure's default system routes, which send traffic between peered VNets directly, bypassing the firewall entirely. This is the classic cause of 'spoke traffic isn't going through the firewall' when the routes appear to be configured correctly.
The Azure Firewall does not have the correct network and application rules configured.
The spoke VNet has the 'Use remote virtual network gateways' setting disabled.
Want more Secure networking practice?
Practice this domainThe AZ-500 exam has 50 questions and must be completed in 120 minutes. The passing score is 700/1000.
Security scenario questions covering Microsoft Entra ID, Defender for Cloud, Azure Key Vault, and application and data security. Some questions are performance-based (PBQs), asking you to complete tasks in a simulated environment.
The exam covers 5 domains: Secure identity and access, Secure compute, storage, and databases, Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel, Manage identity and access, Secure networking. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Microsoft AZ-500 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.