Passing AZ-500: Microsoft Certified Azure Security Engineer Associate

The AZ-500 is a great certification if you work with security and compliance. In this article I'm outlining my experiences in taking this exam online from my home office, as well as free official Microsoft documentation around the areas you'll be tested on.

Tobias Zimmergren

9 Oct 2020

In September 2019 I took the AZ-500 exam, and passed. The Microsoft Exam AZ-500: Microsoft Azure Security Technologies, which if you pass, leads to the Microsoft Certification Azure Security Engineer Associate.

Update September 24th 2020:
Microsoft have updated the exam. There are a few changes from the previous skills measured. You'll find them all below, with links to resources where you can learn more.

I originally wrote this post in September 2019. It has been updated in October 2020 to reflect the latest changes in the exam.

I'm not going to lie - it was a challenging exam.

Who is this exam for?

You're an SME (Subject Matter Expert) in implementing security controls, threat protection, managing identity and access, protecting data, applications and networks in cloud and hybrid environments.
You're interested in your organization's and customers' security posture.
You are familiar with scripting, automation and understands networking and virtualization. Specifically in cloud environments.
A rigid understanding about Azure products and services, and other major Microsoft tech.

Top job titles where the AZ-500 is relevant:

Software Engineer
DevOps Engineer
Data Engineer
Cloud Engineer
Cloud Security Engineer
Manager in Information Security

Source:

https://www.youracclaim.com/org/microsoft-certification/badge/microsoft-certified-azure-security-engineer-associate/lmi

Expectations vs Reality

I had some expectations beforehand that this would be tough. Coming from a dev background, and having a strong emphasis on security in both code and operations I considered myself fairly aware of security topics in Azure - but this exam touches on a lot of things I didn't put as much effort into in the past, and made me aware of gaps in my knowledge that I'm now taking time to fill.

A few topics I would have given more thought before the exam, should I do it again, are:

VNet connectivity and security, subnets, Site-to-Site VPN. Networking and network security in general, and specifically in Azure with regards to VMs.
Dive deeper into Policies in Azure.
Dive deeper into the general practices and capabilities of Firewalls in Azure.

Taking an exam Online

I took my exam from the convenience of my own home, while being constantly monitored online by a remote proctor. This is a convenient way to get exams done, but requires you to prepare your office/room a bit to meet the rigid requirements from Microsoft. If you decide to take an exam from home, please ensure you meet the requirements.

Update 2020: With the COVID-19 pandemic, the norm today is to take the exams at your home/online, and there's great guidance from Microsoft how to make this a successful experience.

Skills measured

There's four main pillars measured in the exam.

With the September 2020 update, the weight of each pillar has shifted. The below percentages are the updated weight.

The links will help you better ramp up for your exam. My recommendation is to open each link, review if you already know and are familiar with it or not, then save the links you need to brush up on. When you have created your links, it's easier to create a study plan to push through.

I always recommend using the official Microsoft Docs documentation for the exam preparations, as it always contains updated material.

Manage identity and access (30-35%)

Manage Azure Active Directory identities

Configure security for service principals
Manage Azure AD directory groups
Manage Azure AD users
Configure password writeback
Configure authentication methods including password hash and Pass-Through Authentication (PTA), OAuth, and passwordless
Transfer Azure subscriptions between Azure AD tenants

Configure secure access by using Azure AD

Manage application access

Manage access control

Configure subscription and resource permissions (and: Add or change Azure subscription administrators)
Configure resource group permissions
Configure custom RBAC roles
Identify the appropriate role
Apply principle of least privilege
Interpret permissions
Check access

Implement platform protection (15-20%)

Implement advanced network security

Configure advanced security for compute

Manage security operations (25-30%)

Monitor security by using Azure Monitor

Monitor security by using Azure Security Center

Monitor security by using Azure Sentinel

Configure security policies

Secure data and applications (20-25%)

Configure security for storage

Configure security for databases

Configure and manage Key Vault

Free AZ-500 training from Microsoft

Microsoft does a great job in providing free online material to prepare. Here are the relevant parts from Microsoft Learn. On-demand, at your fingertips.

Manage Security Operations (Microsoft Learn)
Manage Identity and Access (Microsoft Learn)
Implement virtual machine host security in Azure (Microsoft Learn)
Implement network security in Azure (Microsoft Learn)
Implement resource management security in Azure (Microsoft Learn)
Secure your cloud applications in Azure (Microsoft Learn)

Summary

More information about the skills measured from Microsoft (without links), and more information about taking certifications online can be found here:

MS - Skills measured
MS - About online/proctored exams

Good luck.

Azure Certification Security

Tobias Zimmergren Twitter

Hi, I'm Tobias! 👋 I write about Microsoft Azure, security, cybersecurity, compliance, cloud architecture, Microsoft 365, and general tech!