Study guide · Exam overview
The format, passing score, and four content domains of Microsoft Certified: Cloud and AI Security Engineer Associate, plus what changed when AZ-500 retired.
Exam version notice: This overview follows the Microsoft study guide for Exam SC-500 — Implementing End-to-End Security Controls for Cloud and AI Workloads, objectives checked on October 26, 2026. Azure Security Engineer Associate (AZ-500) retired on August 31, 2026; SC-500 is the current associate path for security engineers who would have studied AZ-500. The certification page gives you 120 minutes and requires a score of 700 or greater. Pricing, languages, and delivery options can change. Confirm them on the Microsoft certification site before you register. Items tagged Extra are useful context that the study guide does not name as a measured skill. Shared cloud vocabulary is on the AZ-900 overview; day-to-day Azure operations are on the AZ-104 overview.
Microsoft Certified: Cloud and AI Security Engineer Associate checks whether you can implement security controls across identity, network, application, data, and compute—and whether you can secure the platforms and identities that AI workloads use. The work is hands-on: configure Privileged Identity Management, place a private endpoint, enable just-in-time VM access, onboard Defender for Cloud, and wire Sentinel connectors. It is a role-based exam. You are not asked only to define a security slogan.
Microsoft describes the candidate as a security engineer who works with architects, administrators, analysts, and developers. Expected background is Azure and hybrid administration for compute, network, and storage, plus strong familiarity with Microsoft Entra ID and familiarity with Microsoft 365 administration. AZ-900 and AZ-104 help. Neither is a required prerequisite.
Book SC-500. Use this table only to see what moved when Azure Security Engineer Associate retired.
| Topic | AZ-500 (retired) | SC-500 (current) |
|---|---|---|
| Credential name | Azure Security Engineer Associate | Cloud and AI Security Engineer Associate |
| Exam code | AZ-500 | SC-500 |
| Status | Retired August 31, 2026 | Current associate path |
| AI workload security | Not a first-class domain focus | Explicit AI controls under Secure compute (Purview DSPM, Agent ID, Foundry, Copilot Studio) |
| Transition | No automatic conversion. Earn SC-500 by passing the new exam. | |
Figures below come from the SC-500 certification page and the study guide reviewed in October 2026.
| Specification | SC-500 |
|---|---|
| Level | Intermediate, role-based. Microsoft calls the credential Cloud and AI Security Engineer Associate. No prerequisite certification is required. |
| Length of test | 120 minutes to complete the assessment. The exam is proctored and may include interactive components. |
| Number of questions | Microsoft does not publish a fixed count on the certification page. Do not treat a practice length as the live exam length. |
| Passing score | 700 or greater on a scale of 1 to 1,000. A scaled score is not the percentage of questions you answered correctly. |
| Recommended experience | Azure and hybrid administration for compute, network, and storage; strong Microsoft Entra ID familiarity; Microsoft 365 administration familiarity. |
| Exam price | Price depends on the country or region where the exam is proctored. Confirm the current fee when you schedule. |
| Validity | Associate certifications expire after 12 months. Renew at no cost with an online assessment on Microsoft Learn during the renewal window. |
| Delivery | Schedule through Pearson VUE. English is updated first. Other languages follow later. |
A blank answer earns no credit. Microsoft exams do not subtract extra points for a wrong answer, so answer every question. If the exam is not offered in your preferred language, you can request an additional 30 minutes. Request accommodations before you sit if you need them. After a failed attempt you can retake the exam 24 hours later. Later retakes wait longer. Confirm the current retake policy with Microsoft.
These ranges are the share of scored content in the study guide checked on October 26, 2026. The 200 practice questions use shares inside those ranges that add to 100 percent: 22%, 28%, 25%, and 25%.
Who can elevate, where secrets live, and which policy blocks a bad deploy.
The heaviest domain. Restrict the data path and prove the network rule that allows it.
AI platforms, servers, and app hosts share this domain.
Find the risk, collect the signal, and automate the response.
The study guide names configuration tasks more often than product slogans. Learn the paired choices first. The same map is in the core notes and flashcards.
| Need | Choose | Remember |
|---|---|---|
| Just-in-time privileged Azure roles | Microsoft Entra Privileged Identity Management | Standing Owner assignments are the distractor. PIM elevates for a time window after approval when configured. |
| Block risky sign-ins to cloud apps | Conditional Access | MFA alone is not a full Conditional Access policy. Combine conditions and grant controls. |
| Store and rotate secrets for apps | Azure Key Vault | App Configuration is for non-secret settings. Managed identity should retrieve vault secrets. |
| Give a PaaS service a private IP | Private endpoint | A service endpoint still uses the service public address and identifies your virtual network. |
| RDP or SSH without a public IP on the VM | Azure Bastion | JIT reduces open management ports; Bastion removes the need for a public management IP. |
| Temporary open management ports | Just-in-time VM access | JIT is not a substitute for Bastion when the stem forbids a public IP entirely. |
| AI data overexposure in Copilot contexts | Microsoft Purview DSPM | Defender for Servers does not classify SharePoint oversharing for Copilot. |
| Central posture and recommendations | Microsoft Defender for Cloud | Sentinel is the SIEM for correlation and response after signals are collected. |
| Collect and investigate security events | Microsoft Sentinel | Connectors, analytics rules, and playbooks live here. CSPM recommendations live in Defender for Cloud. |
| Extra Full Zero Trust architecture paper | Design principles | Useful context. SC-500 measures implementing the named controls, not writing a strategy deck. |
Microsoft says the exam may include interactive components and points you to an exam sandbox so you can try the interface before you sit. This site's practice questions use multiple choice, multiple response, matching, and ordering. Matching and ordering are extra practice for the distinctions in the study guide. They are not a claim about the live item mix.
A typical stem gives a constraint and asks for the first or best action. The contractor needs Contributor but not lasting Owner. The storage account must not be reachable from the public internet. The VM must accept management only through Bastion. Distractors are nearby features that solve a different problem. A private endpoint is not a service endpoint. PIM is not a standing role. Defender for Cloud is not Sentinel.
There is no published extra penalty for a wrong guess. A blank answer earns nothing. On a timed practice exam, answer every item, then use the review to see which domain actually needs work.
A practical sequence if AZ-500 habits still skip the AI controls.
PIM and Conditional Access decide who can act. Key Vault holds secrets. Policy and locks constrain what may exist.
Storage firewall, private endpoint, NSG, Firewall, and Network Watcher effective rules. Say which control answers which stem.
DSPM and Agent ID sit next to Bastion, JIT, disk encryption, and Defender for Containers in the same domain.
Defender for Cloud finds the misconfiguration. Sentinel ingests and automates. Security Copilot assists when workspaces and roles are ready.
Use the four decks until you can answer before the card flips. Revisit misses the next day.
Work through original questions, review every explanation, and return to the notes on domains below 75 percent. Before booking, check every objective and practice unfamiliar scenarios; a repeated-bank percentage is not evidence of exam readiness. Use 120 minutes as the pace of the live exam.
The overview, core notes, flashcards, and practice exams are all published.
Exam format, the 700 passing score, domain weights, and a study plan.
Reference notes for identity, networking, AI and compute hardening, Defender, Sentinel, and Security Copilot.
40 recall cards in four decks, plus memory notes for identity, paths, AI controls, and posture.
200 original questions with custom exams, explanations, and a score report by domain.
A score of 700 or greater is required to pass. Microsoft reports scores on a scale of 1 to 1,000. A scaled score is not the percentage of questions you answered correctly.
Microsoft gives you 120 minutes to complete the assessment. The exam is proctored and may include interactive components. Microsoft does not publish a fixed question count on the certification page.
The study guide checked on October 26, 2026 measures four areas: manage identity, access, and governance (20–25%); secure storage, databases, and networking (25–30%); secure compute (20–25%); and manage and monitor security posture (20–25%).
No. Azure Security Engineer Associate (AZ-500) retired on August 31, 2026. The current path is SC-500 for Microsoft Certified: Cloud and AI Security Engineer Associate. There is no automatic conversion from AZ-500 to the new credential.
Yes. Microsoft associate certifications expire after 12 months unless you renew them. You can renew at no cost by passing an online assessment on Microsoft Learn. Confirm the current policy before you rely on it.
No. The practice questions on this site are original. They are not Microsoft exam items, and a practice score does not predict a result.
Service names and portal labels change. Use the current Microsoft study guide as the authority when it differs from these notes.
Useful companions while you study.
Generate strong random passwords with custom length, characters, symbols, and security options.
Convert structured data between JSON and YAML with formatting and validation.
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Compare two text blocks and highlight added, removed, and changed content.
Exam versions, objectives, prices, languages, and retirement dates can change. Verify the details on the Microsoft Learn certification page before you register. The SC-500 study guide lists the objectives checked on October 26, 2026.
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Microsoft, Azure, and related marks are trademarks of Microsoft Corporation. Certicab is not affiliated with, endorsed by, or sponsored by Microsoft.
Certi