The AZ-500 Exam: Microsoft Azure Security Technologies is one of the most popular Azure certification exams. It is aimed at security professionals who want to validate their skills and knowledge in securing Azure workloads and hybrid environments.
Although my daily job as a developer does not usually require me to manage too many security-related tasks, this exam was an interesting opportunity to explore Azure from a different point of view, while getting a deeper understanding of the best practices to follow when managing a cloud solution on Azure.
In this post, I will share some useful study materials that I have used to prepare for the exam, as well as some tips and preparation techniques that served me well and that hopefully will help you become a certified Azure Security Engineer Associate.
Check if this is the right certification for you
Before you start, you should consider if this is the right certification for you. Microsoft certifications are role-based, which means that they focus on testing the skills and knowledge required for specific job roles. In this case, we are talking about the role of an Azure security engineer.
Security engineers implement security controls and threat protection, manage identity and access, and protect data, applications, and networks.
https://docs.microsoft.com/en-us/learn/certifications/roles/security-engineer
The first thing to do should be to check the official exam page, review the skills and technologies used, and think about how they could be applied to your job. If you find that the description reflects the role that you have (or that you aspire to), then this might be the right certification for you!
Exam Overview
The AZ-500 exam is approximately 2 hours long and consists of 40-60 questions. The questions are usually a mix of multiple-choice, multiple-select, and drag-and-drop questions. The exam is available in multiple languages, including English, Japanese, Korean, and Simplified Chinese.
The passing score is 700 points out of 1000. The questions are weighted differently, so a score of 700 does not mean that you need to answer 70% of the questions correctly. After the exam, you will receive a score report that will show you how you performed in each section; this can be useful to understand which areas you need to focus on if you need to retake the exam.
Passing the exam will earn you the Microsoft Certified: Azure Security Engineer Associate certification. This certification is valid for 1 year, after which you will need to renew it by passing a free renewal assessment.
This exam assumes that you have at least a basic knowledge of the main Azure services and some core cloud concepts. If you are new to Azure, I would recommend starting with the AZ-900 exam, which is a great introduction to the Azure platform and the main cloud concepts (although it is not a requirement for obtaining the Security Engineer Associate certification).
The exam will test your knowledge of the following topics, or functional groups:
- Manage identity and access (25-30%)
- Secure networking (20-25%)
- Secure compute, storage, and databases (20-25%)
- Manage security operations (25-30%)
The percentages represent the relative weight that each section will have in the exam. That means, for example, that during the exam you can expect to find more questions about identity and access than those about secure networking.
For more detailed and up-to-date information about the exam, check the official exam page.
Study materials
There are many resources available to help you prepare for the exam. In this section, I will share some of the study materials that I have used to prepare for the exam.
Microsoft Learn
Microsoft Learn is a great resource for learning about Azure and other Microsoft technologies. It contains a lot of free learning paths, modules, and interactive tutorials that you can use to learn about Azure and prepare for the exam.
For the AZ-500 exam, Microsoft Learn offers four different learning paths, one for each section of the exam:
- AZ-500: Manage Identity and Access
- AZ-500: Implement platform protection
- AZ-500: Secure your data and applications
- AZ-500: Manage security operation
These modules usually include a mix of text, videos, and knowledge checks, as well as some practical exercises where you can use your Azure subscription to try out the concepts that you have learned.
Microsoft Learn also offers some exam readiness videos, which offer you a high-level overview of the exam topics. These are the videos available for the AZ-500 exam:
- Preparing for AZ-500 - Manage identity and access (1 of 4)
- Preparing for AZ-500 - Implement platform protection (2 of 4)
- Preparing for AZ-500 - Manage security operations (3 of 4)
- Preparing for AZ-500 - Secure data and applications (4 of 4)
Microsoft Docs
The Microsoft Docs website contains the official documentation for all Microsoft products, including Azure. While not strictly related to the exam, the documentation is a great resource to learn more about the topics covered in the exam, and it is also a great reference to keep handy when you are working with Azure.
Pluralsight
If you like to prepare by watching video courses, Pluralsight is a great resource. It is a paid service, but you can get a free trial that will give you access to all the courses for a limited period. This should be enough to complete the courses that you are interested in.
For the AZ-500 exam, I would recommend the dedicated AZ-500 certification path, which contains courses for each section of the exam, for a total of around 16 hours of content.
YouTube
If you prefer to learn by watching videos, many free resources are available on YouTube. Here I recommend the Study Cram by John Savill.
This video can be helpful to get an overview of the exam topics and to identify the areas that you need to focus on or to get a quick refresher before taking the exam.
Strategies for preparing for the exam
Here are some strategies and tips that can help you prepare for the exam.
Review the official exam page
The first thing to do is to review the official exam page and check in greater detail the skills and technologies that you will be tested on. From here, you can visit the official study guide, which contains a detailed list of all the skills measured in the exam, as well as all the Azure services that you should be familiar with. You could also use this as a checklist to track your progress, and to ensure that you do not miss any important topic before taking the exam. The study guide also includes links to the official documentation, which is a great resource to learn more about the topics covered in the exam.
Be sure to review periodically the exam page and the study guide, as they are updated regularly to reflect the latest changes in the exam.
Get an understanding of the key concepts
I usually organize my study time by identifying three areas in which I need to train before taking a certification exam. The first area is content knowledge.
Here, my recommendation is to start your study path by trying to get a basic understanding of all the key concepts and services. In this phase you do not need to go too deep into every detail; instead, you should focus on learning about the main services and their features, what they are used for, and when you should use them. With this basic understanding, you should be able to at least identify the correct service or feature to choose for each different requirement. Of course, this knowledge alone will not make you an expert on all these products, but it is the foundation on which you can start building.
For example, you could start by following the learning paths on Microsoft Learn or Pluralsight. These courses usually provide a good overview of the topics covered in the exam, and they can help you get a basic understanding of the key concepts.
Test your knowledge and identify your weaknesses
The second area in which I divide my study time is test-taking practice.
My advice here is to find yourself some practice exams and to use them often to test your knowledge and identify your weak points. I usually recommend the official practice exams by MeasureUp because they are extremely high quality, but they are not cheap.
You could try using these practice exams as a sort of “end of unit knowledge check”; whenever you reach the end of the courses for one of the functional groups, you could take a series of practice exams on those topics. Reviewing the concepts that you have learned will help you memorize them and will also help you identify if there are any topics on which you should focus a bit more.
At the same time, taking a lot of practice exams improves your test-taking skills. When you take the actual exam, you will know what to expect, you will be prepared for how the questions are structured, and you will be able to answer faster.
To get an idea of what the exam experience will be like, you could also try the free exam sandbox by Microsoft Learn.
Remember: practice tests are meant to only get you some practice and help you review what you have already learned; they should not be used as your primary study method.
Fill the gaps in your knowledge
After taking some practice exams you may find that some topics were not covered deeply enough by the courses, or that you have not fully understood something. These weak points are what you should focus on next.
One of the best ways to fill in those gaps is by using the official Microsoft documentation (which should always be your ultimate source of truth for Microsoft certifications).
Although a bit outdated, there is a useful GitHub repository that contains links to specific documentation pages for many of the topics of the exam.
Get hands-on experience
The third and final area is hands-on practice. This area is especially important for the AZ-500 exam because here you are required to have practical experience in the administration of many Azure services. As you can read from the skills outline, you should know where to go and what to use when you need, for instance, to configure the connectivity rules for subnets in a virtual network, deploy a firewall, or perform an access review.
If you already work as a security engineer and use some of those Azure services, you can use that to your advantage and draw on your personal experience.
Otherwise, my advice here is to get yourself a personal Azure subscription and start playing around with it. You could start with the skills outline from the official study guide and try to think of a series of simple practical tasks that you can use to apply those skills. Some sample tasks could be:
- Configure a SQL Server and Database to send audit logs to a storage account and a Log Analytics workspace
- Add some sample users to Azure AD and create an access review
- Create a policy definition and assign it
- Create custom Azure and Azure AD roles
- Configure network rules on a network security group to allow communication only from an application security group
- …
This can prove especially useful when you are in doubt about how some service or feature works.
Quickly refresh your knowledge before the exam
Use the last couple of days before the exam to quickly review all the core concepts. For this, you could use the official study guide as a checklist, or watch the study cram or exam readiness videos listed above.
Don’t worry about having to memorize everything
The passing score for the exam is 700 points out of 1000. This means that you do not have to answer every question correctly to pass the exam. Maybe you are an expert in most of the topics, but you only have some general knowledge of services like Defender, or maybe you work as a security engineer, but you have never actually used Sentinel in practice; that could still be enough to pass the exam.
My advice here is that you do not need to worry about having to memorize every single detail about every single service. Instead, study until you feel confident enough and you are satisfied with the results of your exam simulations. I am sure this will be enough to do great on the exam!
Schedule your exam early
Finally, my last piece of advice is to schedule the exam as soon as possible. You will find that having a scheduled date can be a great motivation for studying consistently!
Conclusion
I hope you found this article useful. If you have any questions or feedback, feel free to reach out to me!
