Azure AZ-500 Practice Test

AZ-500 practice test: what's covered

• Azure Security Technologies
• January 2026 Blueprint

Free AZ-500 sample questions

1. A platform engineer must create and remove Azure role assignments for resources in resource group RG-App. The engineer must not modify the resources themselves. Select one.

   • A. Assign Contributor at RG-App
   • B. Assign User Access Administrator at RG-App
   • C. Assign Owner at the subscription
   • D. Assign Global Administrator in Microsoft Entra ID
   Show answer

   Correct: B. User Access Administrator at the resource-group scope can manage Azure role assignments without granting broad resource-management permissions. The scope limits the authority to RG-App.

2. An automation identity must read virtual-machine properties and restart existing virtual machines in one resource group. It must not create, delete, resize, or change networking. Select exactly TWO Actions for a custom Azure role.

   • A. Microsoft.Compute/virtualMachines/read
   • B. Microsoft.Compute/virtualMachines/restart/action
   • C. Microsoft.Compute/virtualMachines/write
   • D. Microsoft.Network/*
   Show answer

   Correct: A and B. The read action permits configuration inspection and restart/action permits restart. Write would allow changes to VM configuration, and a wildcard for Microsoft.Network would violate least privilege.

3. Which Microsoft Entra Privileged Identity Management (PIM) assignment type requires a user to activate the role before using its permissions? Select one.

   • A. Active permanent assignment
   • B. Eligible assignment
   • C. Direct deny assignment
   • D. Classic administrator assignment
   Show answer

   Correct: B. An eligible PIM assignment makes the user a potential role holder who must activate under the configured conditions. Active assignments already provide the role permissions.

4. A tenant with Microsoft Entra ID P1 must require multifactor authentication (MFA) for administrators without risking tenant lockout during rollout. Two cloud-only emergency access accounts already exist and are monitored. Select exactly TWO actions.

   • A. Exclude the emergency access accounts from the Conditional Access policy
   • B. Start the policy in report-only mode and validate sign-in results before enabling it
   • C. Enable the policy for all users with no exclusions immediately
   • D. Use Security defaults and Conditional Access simultaneously to create duplicate MFA enforcement
   Show answer

   Correct: A and B. Emergency access exclusions preserve recovery, and report-only evaluation provides impact evidence before enforcement. Immediate universal enforcement risks lockout; combining overlapping baseline mechanisms is not the controlled rollout requested.

5. A daemon application runs without a signed-in user and must read directory data through Microsoft Graph. Which permission type should the app registration request? Select one.

   • A. Delegated permission
   • B. Application permission
   • C. User consent only
   • D. An Azure resource lock
   Show answer

   Correct: B. A background daemon uses application permissions because no user context exists. An administrator typically grants tenant-wide consent for the required application permission.

Last updated: 2026-10-19

AZ-500 practice test FAQ

Related practice tests

• SC-200 practice test
• SC-300 practice test
• SC-100 practice test
• AZ-104 practice test
• SC-900 practice test
• SCS-C02 practice test