Microsoft AZ-500: Microsoft Azure Security Technologies

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel

   What is the difference between an Azure Policy definition and an initiative?

   1. AA definition is a single rule, and an initiative groups several definitions so they can be managed together
   2. BA definition is a billing plan, and an initiative is the discount that applies to the billing plan
   3. CA definition runs only on virtual machines, and an initiative runs only on storage accounts
   4. DA definition is a user role, and an initiative is a group of users who share one sign-in password
   Show answer and explanationHide answer

   Correct answer: A

   A policy definition is a single rule, and an initiative groups definitions for assignment and management together. The other descriptions confuse policy with billing and identity concepts.

2. Question 2Secure compute, storage, and databases

   What does just-in-time VM access in Microsoft Defender for Cloud do?

   1. AIt encrypts the disks of a virtual machine at the moment it is first started by an operator
   2. BIt creates a virtual machine on demand from a template when a user requests a development environment
   3. CIt opens management ports for a limited time for approved requests and closes them afterwards
   4. DIt installs security patches on virtual machines at the first sign-in of each day automatically
   Show answer and explanationHide answer

   Correct answer: C

   Just-in-time access opens management ports for approved, time-limited requests and closes them afterwards. Provisioning, disk encryption and patching are different features.

3. Question 3Secure identity and access

   Which built-in Azure role lets a user manage role assignments for others without changing the resources themselves?

   1. AUser Access Administrator, which manages role assignments for other users on a scope
   2. BContributor, which creates and changes resources but cannot assign roles to other users
   3. CReader, which views resources and their configuration without making any changes to them
   4. DSecurity Reader, which views security data in Defender for Cloud without assigning any roles
   Show answer and explanationHide answer

   Correct answer: A

   User Access Administrator can manage role assignments without managing the resources. Contributor cannot assign roles, and Reader and Security Reader cannot change assignments.

4. Question 4Secure networking

   What is the purpose of an application security group in Azure?

   1. AIt groups network interfaces by workload role so that NSG rules can refer to the group rather than to IP addresses
   2. BIt encrypts traffic between two virtual machines in the same subnet by using a shared encryption key
   3. CIt routes traffic between subscriptions through a central hub with no filtering applied to the flows
   4. DIt stores application logs for the virtual machines in one central workspace for later analysis
   Show answer and explanationHide answer

   Correct answer: A

   Application security groups let NSG rules refer to workloads by role instead of by IP address. They do not encrypt traffic, route it between subscriptions or store logs.

5. Question 5Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel

   What does a Microsoft Defender for Cloud secure score represent?

   1. AThe speed of the network connection between the resources and the Defender service endpoints
   2. BThe number of alerts that were raised in the last 24 hours across all subscriptions in the tenant
   3. CThe total cost of the security plans enabled on a subscription, expressed as a percentage of spend
   4. DA measure of security posture based on the recommendations that have been completed across resources
   Show answer and explanationHide answer

   Correct answer: D

   The secure score reflects how many recommendations are completed across resources. Alert counts, cost and network speed are not what the score measures.