MicrosoftAssociate levelAZ-500

AZ-500 exam dumps: 273 free Azure Security Engineer Associate practice questions

Free AZ-500 practice questions for the Microsoft Azure Security Technologies exam, with the correct answer and a full explanation for every option. Read the first 10 below, browse all 273 by number, or take a timed practice exam.

Question bank last updated May 2025

Start timed practice exam Browse all 273 questions

Free AZ-500 practice questions

Questions 1 to 10 of 273

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

AZ-500 Question 1

Single answer

You are administering an Azure environment where a new web application needs to be restricted solely to members of the Finance department. Additionally, any Finance user accessing the app from outside the corporate network must complete multi-factor authentication (MFA). Which approach should you implement to best meet these requirements?

A
A. Add all Finance users to an Azure AD security group, assign that group to the application, and create a Conditional Access policy that requires MFA for sign-ins from external networks.
B
B. Set the app’s permission scope to ‘All users’ and enable Pass-through Authentication to enforce MFA during every sign-in attempt.
C
C. Enable Azure AD Privileged Identity Management (PIM) for the Global Administrator role and require MFA for activation of that role.
D
D. Configure a Conditional Access policy without specifying user groups, and only require MFA if a user signs in with a personal Microsoft account.

Show answer and explanation

Correct answer: A

Explanation

To meet the requirements of restricting access to a specific department while enforcing MFA outside a trusted network, follow Azure best practices by leveraging group-based application assignments and Conditional Access policies. Specifically, assign the application to a dedicated Azure AD group containing the Finance users and create a Conditional Access policy that triggers MFA for sign-ins originating outside the corporate IP range (listed as a named location). Further details on configuring Conditional Access policies and managing groups can be found in Microsoft documentation: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview.

A. Correct.
A. Correct. By assigning the app to an Azure AD group containing only the Finance users, and configuring a Conditional Access policy to require MFA when sign-ins originate from outside the corporate network (e.g., a named location), you effectively restrict access to the Finance department and add an extra layer of security for external logins.
B. Incorrect.
B. Incorrect. Setting the app’s permission to ‘All users’ does not restrict access to the Finance department. Pass-through Authentication alone does not address the specific requirement of MFA being triggered only for external sign-ins.
C. Incorrect.
C. Incorrect. Enabling Azure AD PIM for the Global Administrator role is useful for privileged role management, but this does not enforce MFA specifically for the Finance users accessing the web application. It also does not handle departmental restrictions.
D. Incorrect.
D. Incorrect. A Conditional Access policy that fails to specify the correct user group and only targets personal Microsoft accounts does not meet either the department restriction or the MFA requirement for corporate users accessing from external networks.

AZ-500 Question 2

Select 2

You are an Azure Security Engineer at Contoso. Your organization requires just-in-time (JIT) access for privileged roles using Azure AD Privileged Identity Management (PIM). You have assigned the Global Administrator role to specific users through PIM, but they are not being prompted for multi-factor authentication when activating their privileges. Which two steps should you take to ensure that MFA is required on activation for Global Administrator? (Each correct answer presents part of the solution. Choose two.)

A
Enable 'Require multi-factor authentication on activation' for the Global Administrator role in PIM
B
Create a custom Conditional Access policy for the Global Administrator role that restricts sign-ins to trusted locations only
C
Turn on 'User consent for apps' in the Azure AD User settings
D
Configure the Global Administrator role membership as 'Eligible' instead of 'Active' within PIM

Show answer and explanation

Correct answers: A, D

Explanation

To ensure that Global Administrator privileges follow just-in-time and multi-factor authentication requirements, you must configure the role as 'Eligible' and enable the 'Require multi-factor authentication on activation' setting in Azure AD Privileged Identity Management. This approach aligns with the principle of least privilege, minimizes standing administrative access, and aligns with Microsoft best practices. For more details, refer to the official Microsoft documentation on configuring Azure AD Privileged Identity Management.

A. Correct.
Correct: Enabling 'Require multi-factor authentication on activation' in PIM ensures that users assigned to the role must complete MFA before activating the privileges.
B. Incorrect.
Incorrect: Restricting sign-ins to trusted locations does not enforce MFA on activation. Conditional Access can be useful, but it does not directly enable the just-in-time MFA requirement in PIM without also requiring MFA explicitly.
C. Incorrect.
Incorrect: User consent for apps is unrelated to requiring MFA during role activation. This setting governs how users grant permissions to third-party apps, not privileged role activation.
D. Correct.
Correct: Configuring the role as 'Eligible' requires the user to go through the activation process, during which MFA can be enforced. If the role is set to 'Active,' the user is granted standing privileges and will bypass the just-in-time activation steps.

AZ-500 Question 3

Select 2

You are the Security Administrator for an organization whose Azure AD tenant has technical support staff permanently assigned to the Global Administrator role. Leadership wants to follow the principle of least privilege by providing elevated privileges only when needed and requiring approval from the senior security team before support staff can activate Global Administrator privileges. Which two steps should you take?

A
Enable Azure AD Privileged Identity Management (PIM) and make support staff “Eligible” for the Global Administrator role.
B
Configure the role in PIM to require approval for any role activation.
C
Remove all role assignments from support staff and rely on an external provisioning tool to add or remove roles as needed.
D
Enable multi-factor authentication for support staff on every sign-in.

Show answer and explanation

Correct answers: A, B

Explanation

To address the need for just-in-time privileged access and an approval workflow, the most direct approach is to use Azure AD Privileged Identity Management. By assigning support staff as 'Eligible' users for the Global Administrator role (Option 1) and configuring the role settings to require approval for activation (Option 2), you ensure that privileges are elevated only when needed, and a senior security admin must approve each activation. Refer to Microsoft’s documentation on Privileged Identity Management (https://docs.microsoft.com/azure/active-directory/privileged-identity-management) for detailed guidance on how to configure these settings.

A. Correct.
Option 1 is correct. Azure AD Privileged Identity Management allows you to assign users as 'Eligible' rather than permanently active in a privileged role. This feature is necessary to implement just-in-time access to Global Administrator privileges.
B. Correct.
Option 2 is correct. Requiring approval for role activation ensures that a senior security admin must approve any elevation of privileges, fulfilling the leadership's requirement for additional oversight.
C. Incorrect.
Option 3 is incorrect. Removing all role assignments and depending on an external tool doesn't satisfy the requirement to provide elevated privileges in a controlled but still manageable way. External provisioning doesn’t inherently offer just-in-time access or approval workflows for privileged roles within Azure AD.
D. Incorrect.
Option 4 is incorrect. While enabling MFA is highly recommended for all users (including privileged ones), it does not address the specific requirement of requiring approval for role elevation. MFA alone does not provide just-in-time role activation or the necessary approval process.

AZ-500 Question 4

Single answer

You manage a resource group named 'AppRG' that hosts multiple Azure resources. You need to give a developer named DevUser the ability to manage and create resources within AppRG, but ensure that DevUser cannot delete the resource group or modify any RBAC role assignments. Which built-in role assignment would best fulfill this requirement?

A
Assign the Owner role at the resource group scope to DevUser
B
Assign the Contributor role at the resource group scope to DevUser
C
Assign the Contributor role at the subscription scope to DevUser
D
Assign the Reader role at the resource group scope to DevUser

Show answer and explanation

Correct answer: B

Explanation

To meet the scenario requirements, you want to ensure that DevUser can manage resources within the AppRG resource group but not alter RBAC assignments or delete AppRG itself. According to Azure RBAC documentation, the Contributor role at a specific scope (in this case, the resource group) is the best fit, as it allows resource management without granting higher-level access like managing role assignments (which Owner would). Reference: https://learn.microsoft.com/azure/role-based-access-control/built-in-roles#contributor.

A. Incorrect.
Option 1: Owner at the resource group level would allow DevUser to manage resources, but it would also enable them to manage access and potentially delete the resource group, which exceeds the requirement.
B. Correct.
Option 2: Contributor at the resource group level grants DevUser the ability to view, create, modify, and delete resources within AppRG without granting rights to manage RBAC assignments or delete the resource group. This precisely matches the requirement.
C. Incorrect.
Option 3: Contributor at the subscription level gives DevUser the ability to manage resources across the entire subscription, not just within AppRG. This goes beyond the intended scope.
D. Incorrect.
Option 4: Reader at the resource group level would only permit DevUser to view resources, not create or modify them. This does not meet the requirement.

AZ-500 Question 5

Single answer

You are a security engineer for a company that wants to delegate the ability to manage role assignments for a specific resource group to its InfoSec team. The InfoSec team must not have permissions to create, modify, or delete any resources within that resource group. Which Azure built-in role should you assign to meet this requirement?

A
Owner
B
User Access Administrator
C
Contributor
D
Reader

Show answer and explanation

Correct answer: B

Explanation

When you want a group or user to manage role assignments (i.e., grant or revoke permissions) without granting other privileges within an Azure resource group, you should use the User Access Administrator built-in role. This matches the least-privilege principle, providing only the capability to control access. For more information, see the Microsoft documentation on built-in roles for role-based access control (RBAC): https://learn.microsoft.com/azure/role-based-access-control/built-in-roles

A. Incorrect.
Incorrect. The Owner role has full access to all resources, including the ability to manage role assignments. However, it provides more permissions than needed because it allows creation, modification, and deletion of resources.
B. Correct.
Correct. The User Access Administrator role is specifically designed to manage role assignments without granting rights to create or modify resources. This matches the requirement to delegate access control management without other resource permissions.
C. Incorrect.
Incorrect. The Contributor role can create, manage, and delete resources in addition to managing role assignments. This exceeds the minimum privilege needed and does not conform to the 'least privilege' principle.
D. Incorrect.
Incorrect. The Reader role only provides read access to resources and does not include the ability to manage role assignments.

AZ-500 Question 6

Single answer

Your company has a resource group named RG1 that contains multiple Azure resources, including virtual machines, Azure SQL databases, and storage accounts. A new junior engineer needs to create, start, stop, and manage virtual machines but should not be able to modify or delete other types of resources in RG1. Which built-in role assignment should you configure to meet these requirements?

A
Assign the Contributor role at the subscription scope
B
Assign the Virtual Machine Contributor role at the RG1 scope
C
Assign the Virtual Machine Operator role at the RG1 scope
D
Assign the Owner role at the subscription scope

Show answer and explanation

Correct answer: B

Explanation

Azure provides built-in roles for role-based access control (RBAC) to granularly manage resources. 'Virtual Machine Contributor' is designed to grant permissions solely for creating and managing VMs and is best assigned at the smallest appropriate scope, in this case, RG1, to limit exposure. For more information, see Azure RBAC built-in roles in the Microsoft documentation: https://learn.microsoft.com/azure/role-based-access-control/built-in-roles.

A. Incorrect.
Incorrect. The Contributor role at the subscription scope grants too many permissions across all resources in the subscription, not just virtual machines, and exceeds the principle of least privilege.
B. Correct.
Correct. The Virtual Machine Contributor role at the RG1 scope allows the user to create, manage, start, stop, and restart virtual machines within RG1 without granting permissions to modify non-VM resources.
C. Incorrect.
Incorrect. The Virtual Machine Operator role allows actions like starting and stopping VMs but does not allow creating or fully managing them.
D. Incorrect.
Incorrect. The Owner role at the subscription scope grants full permissions at the highest level, which is far more than required for managing VMs in RG1.

AZ-500 Question 7

Single answer

You are a security engineer for Contoso. The HR department requests a custom role that grants the ability to reset passwords and update contact information only for user accounts in the HR department. They also need to ensure that no permissions are granted to manage service principals or other users outside the HR department. You decide to create a custom Microsoft Entra role to satisfy these requirements. Which approach should you use?

A
Create a custom Azure RBAC role scoped to a resource group that contains all HR employees.
B
Assign the built-in User Administrator role directly to the HR department’s global security group.
C
Create a custom Microsoft Entra role with the required directory permissions, configure an Administrative Unit (AU) containing only the HR users, and then assign the role to that AU.
D
Create a custom Microsoft Entra role with Reset Password and Manage Service Principal permissions, assigned at a global directory scope.

Show answer and explanation

Correct answer: C

Explanation

When controlling permissions that affect user accounts in Microsoft Entra ID, using Administrative Units (AUs) is a best practice. You create a custom Microsoft Entra role that grants only the necessary permissions, such as resetting passwords and editing profiles, and scope it to the AU covering only HR users. This prevents managing accounts outside the HR department and avoids granting privileges related to service principals. Refer to Microsoft’s documentation on 'Administrative Units in Microsoft Entra ID' for more details on configuring fine-grained directory permissions.

A. Incorrect.
Option 1 is incorrect because Azure RBAC roles apply to Azure resources (e.g., subscriptions, resource groups, and resources) rather than directory objects like users. This does not limit password resets and contact updates to only the HR department’s users.
B. Incorrect.
Option 2 is incorrect because the built-in User Administrator role typically allows managing passwords for all users except for global admins, not just HR accounts. It does not limit permissions to a specific subset of users.
C. Correct.
Option 3 is correct. Creating a custom Microsoft Entra role with only the needed permissions (e.g., resetting passwords, updating profile attributes) and assigning the role to an Administrative Unit containing only HR users ensures that the role applies only to that group. This method prevents managing service principals or other users outside the HR department.
D. Incorrect.
Option 4 is incorrect because assigning a custom Microsoft Entra role at the global directory scope would allow the assigned user to reset passwords for all users, not just the HR department.

AZ-500 Question 8

Single answer

You are an Azure security engineer for a company that needs to create a custom Azure role granting a development team the ability to start and stop virtual machines in a specific resource group. The development team’s Microsoft Entra ID security group must be assigned this role, and the team should not be able to delete any virtual machines. Which is the best way to achieve this requirement?

A
Create a custom Azure role granting 'Microsoft.Compute/*' privileges at the subscription scope and exclude 'virtualMachines/delete', then assign it to the group using the subscription Role Assignments.
B
Create a custom Azure role listing only the required VM actions and excluding 'Microsoft.Compute/virtualMachines/delete' at the resource group scope, then assign it to the Entra security group at that resource group scope.
C
Use the built-in Virtual Machine Contributor role directly at the resource group scope and rely on service-level security to block VM deletions.
D
Create a custom Microsoft Entra role in the Microsoft Entra admin center with only the start and stop actions, then assign that role to the group at the directory level.

Show answer and explanation

Correct answer: B

Explanation

To manage resource-level permissions effectively, you should create a custom Azure role (rather than a Microsoft Entra directory role) that includes only the necessary actions within the scope of the target resource. In this scenario, granting start/stop privileges and excluding 'virtualMachines/delete' ensures compliance with least-privilege principles. Assigning that custom role to the Microsoft Entra ID security group at the resource group scope is a recommended approach. For more details, refer to Microsoft’s documentation on custom roles and role assignments in Azure RBAC: https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles.

A. Incorrect.
Option 1 is incorrect. Assigning the custom role at the subscription scope would grant the group unnecessary permissions across the entire subscription, violating the principle of least privilege. Excluding 'virtualMachines/delete' actions is correct, but the scope is too broad.
B. Correct.
Option 2 is correct. Defining a custom Azure role that includes only the required start and stop actions, excluding deletions, and assigning it at the resource group scope is a best practice. This ensures that permissions are limited to the intended resource group, aligning with the principle of least privilege. Additionally, assigning it to the Microsoft Entra group at the resource group scope streamlines ongoing management.
C. Incorrect.
Option 3 is incorrect. While the built-in Virtual Machine Contributor role closely matches some required permissions, it still permits VM deletions. Relying on service-level security to block deletions can be cumbersome and is not the recommended approach when a custom role can precisely define allowed and denied actions.
D. Incorrect.
Option 4 is incorrect. Microsoft Entra roles govern directory-level tasks (for example, user administration, conditional access), but Azure roles govern access to Azure resources. A custom role for Azure resources must be created and assigned through Azure RBAC, not as a Microsoft Entra role at the directory level.

AZ-500 Question 9

Single answer

You have created a custom Azure role definition that allows users to read all resources and start or restart virtual machines, but you originally defined the custom role at the resource group scope. Now you want to assign this role to users at the subscription scope so they can manage VM operations across all resource groups. However, you cannot see the custom role listed when attempting to assign it at the subscription level. Which action enables you to use this custom role at the subscription scope?

A
Redefine the role at the subscription scope so that the role definition is created and stored at that higher scope.
B
Grant the role assignment for this role at the resource group scope and rely on it to automatically propagate to the subscription scope.
C
Enable the 'assignmentAllowedScopes' setting in Microsoft Entra ID to permit broader usage of the existing role definition.
D
Create a new custom role in Microsoft Entra ID (formerly Azure AD) rather than Azure Resource Manager, so it appears at the subscription scope.

Show answer and explanation

Correct answer: A

Explanation

When creating custom roles in Azure RBAC, the role definition is bound to a specific scope (management group, subscription, resource group, or resource). If you need to assign the same role at a broader or different scope, you must define the role at that desired scope. According to Microsoft documentation (https://learn.microsoft.com/azure/role-based-access-control/custom-roles), custom roles cannot automatically move to higher-level scopes once created. Instead, the role needs to be redefined or updated at the correct scope for it to become available there.

A. Correct.
Correct. In Azure Role-Based Access Control (RBAC), a custom role is only visible and assignable within the scope where it was defined and its descendants. If you create a custom role at a resource group scope, it will not appear at the subscription scope. To assign it at the subscription level, you must define (or re-create) the role at the subscription scope.
B. Incorrect.
Incorrect. Role definitions created at a lower scope (such as a resource group) do not automatically propagate upward to a higher scope (e.g., a subscription). They remain restricted to their defined scope and its child resources.
C. Incorrect.
Incorrect. 'assignmentAllowedScopes' is a setting used when defining custom roles in Azure Resource Manager templates to list acceptable scopes. However, simply enabling or modifying this property in Microsoft Entra ID does not move a role definition created at the resource group scope into the subscription scope.
D. Incorrect.
Incorrect. There is a distinction between Azure resource roles (Azure RBAC) and Microsoft Entra ID administrative roles. Creating a Microsoft Entra ID role does not grant Azure resource-level access at the subscription level. You need a custom role defined in Azure Resource Manager at the correct scope for subscription assignments.

AZ-500 Question 10

Select 2

You are an Azure security engineer responsible for reducing excessive privileges across multiple Azure subscriptions using Microsoft Entra Permissions Management. After analyzing Microsoft Entra Permissions Management's usage data, you discover that several service accounts have rarely used permissions assigned, but your application team fears that removing them outright could cause operational issues. Which two actions should you take to safely rightsize privileges for these accounts using Microsoft Entra Permissions Management?

A
Validate infrequent usage by reviewing permissions utilization in Microsoft Entra Permissions Management, then test changes in a non-production environment before finalizing removals.
B
Immediately remove any rarely used permissions to ensure a strict least-privilege setup across all Azure subscriptions.
C
Create a new Azure role definition based on permissions usage analytics from Microsoft Entra Permissions Management and implement it gradually to observe any unexpected impacts.
D
Rely on Azure Role-Based Access Control (RBAC) logs exclusively to identify unused permissions, removing them without further testing or staged rollouts.

Show answer and explanation

Correct answers: A, C

Explanation

When rightsizing permissions in Azure, Microsoft Entra Permissions Management helps you identify unused or rarely used privileges. However, implementing least privilege without breaking production requires a staged approach, including thorough testing and custom role design. By combining its usage analytics with best practices, such as creating and testing updated role definitions in a non-prod environment, you reduce security risk while avoiding unintended outages. For more information, refer to Microsoft's documentation on implementing and managing Microsoft Entra Permissions Management: https://learn.microsoft.com/azure/active-directory/permissions-management.

A. Correct.
Option 1 is correct. Verifying actual usage data from Microsoft Entra Permissions Management and testing changes in a controlled environment is a recommended best practice. This approach allows you to confirm that removing certain privileges will not break critical workflows.
B. Incorrect.
Option 2 is incorrect. Immediately removing all rarely used permissions without a testing phase could introduce stability issues, especially if those privileges are occasionally needed. Overly aggressive privilege removal can disrupt production activities.
C. Correct.
Option 3 is correct. Creating a custom role or a refined role definition using the analytics from Microsoft Entra Permissions Management and rolling it out gradually is a strategic way to ensure minimal disruption. You can revise it further as you learn more about actual usage.
D. Incorrect.
Option 4 is incorrect. Relying solely on Azure RBAC logs and removing permissions without referencing Microsoft Entra Permissions Management data or testing can lead to misconfiguration. Permissions Management provides deeper insights and recommended actions based on actual usage patterns.

Timed practice exam

Take a AZ-500 practice test under exam conditions

70 questions in 100 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

What the AZ-500 exam covers

Official Microsoft Azure Security Technologies exam domains and weightings.

Manage Identity and Access
25% of exam
Secure Networking
20% of exam
Secure Compute, Storage, and Databases
20% of exam
Manage Security Operations
25% of exam

All 273 AZ-500 practice questions

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them.

AZ-500 exam dumps FAQ

Are these AZ-500 dumps real exam questions?

No. These are original practice questions written to the Microsoft Azure Security Technologies exam objectives, not questions copied from a live exam. Memorising leaked questions violates Microsoft's candidate agreement and stops working the moment the question pool rotates. Use this bank to check your understanding of each domain and to find the topics you still need to study.

How many AZ-500 practice questions are there?

273 questions, each with the correct answer, an explanation of the answer, and a note on why every other option is wrong. The first 10 are on this page and every question has its own page linked below.

Are the AZ-500 exam dumps free?

Yes. Every question, answer and explanation on this page and the linked question pages is free to read without an account. A free HydraNode account adds timed practice exams, scoring and progress tracking across attempts.

How do I take a timed AZ-500 practice test?

Sign in and start the Microsoft Azure Security Technologies exam on HydraNode. A session gives you 70 questions drawn from this bank in 100 minutes, then a score report with a per-question review.

What topics does the AZ-500 exam cover?

The official exam domains are: Manage Identity and Access; Secure Networking; Secure Compute, Storage, and Databases; Manage Security Operations.

More Microsoft exam dumps

All Microsoft exams

AZ-305243 questions

Azure Solutions Architect Expert exam dumps

Designing Microsoft Azure Infrastructure Solutions

AZ-700310 questions

Azure Network Engineer Associate exam dumps

Designing and Implementing Microsoft Azure Networking Solutions

AZ-400306 questions

Azure DevOps Engineer Expert exam dumps

Designing and Implementing Microsoft DevOps Solutions

AI-102493 questions

Azure AI Engineer Associate exam dumps

Designing and Implementing a Microsoft Azure AI Solution

AI-900286 questions

Azure AI Fundamentals exam dumps

Microsoft Azure AI Fundamentals

AZ-104289 questions

Azure Administrator Associate exam dumps

Microsoft Certified: Azure Administrator Associate