Study the AI security section separately.
A passer with an AZ-500 background says existing knowledge covered most of the exam, but the new AI material needed dedicated study.
Microsoft Certified: Cloud and AI Security Engineer Associate (SC-500) Exam Guide
Validates knowledge of securing Azure, hybrid and AI workloads through identity, data, network and compute controls and monitoring.
SC-500 tests whether you can configure security controls across Azure identity, data, networks, compute and AI services, then monitor them with Defender for Cloud and Sentinel. Build each control in your own subscription and practise long scenario questions.
Understand the exam
Syllabus
Manage identity, access, and governance20–25%
- Secure access to resources by using Microsoft Entra ID
- Secure secrets and keys by using Azure Key Vault
- Implement governance to enforce security and regulatory compliance
Example scenario: Developers keep giving themselves Owner on production subscriptions. Which controls would stop this and show who still has too much access?
Secure storage, databases, and networking25–30%
- Implement security for storage accounts
- Implement security for databases
- Implement security for Azure network services
Example scenario: A web app must reach an Azure SQL database without the database having a public endpoint. What would you configure?
Secure compute20–25%
- Implement security for AI
- Implement security for servers and virtual machines (VMs)
- Implement security for application platform services
Example scenario: An AI agent built in Copilot Studio can read HR documents it should not see. Which tools would show the exposure and limit the agent's access?
Manage and monitor security posture20–25%
- Manage security posture by using Defender for Cloud
- Implement activity and event collection in Microsoft Sentinel
- Implement Microsoft Security Copilot
Example scenario: Your company also runs workloads in AWS. How would you bring them into the same security posture view as Azure?
Official SC-500 study guide · Updated July 31, 2026
Format
- Questions
- 40–60
- Duration
- 2h
- Passing score
- 700 / 1000
- Delivery
- Test centre or online
- Languages
- English, Japanese, Chinese (Simplified), Chinese (Traditional), Korean, German, French, Italian, Portuguese, Spanish
Question types
Choose the best answer from the options, or the stated number of answers when a question asks for more than one.
CertUp example
Administrators should hold the Owner role only while they are doing a task, and each activation needs approval. What should you use?
Show answer
A. Privileged Identity Management gives time-limited role activation with approval.
Drag items from a list into the matching places; an item can be used once, more than once or not at all.
CertUp example
Drag each need to the Azure service that meets it. The needs are store application secrets, filter web traffic for common attacks, and find misconfigured resources.
Show answer
Store application secrets → Azure Key Vault, filter web traffic for common attacks → Web Application Firewall, find misconfigured resources → Defender for Cloud.
Pick one value from each drop-down list in a block of text or a diagram to complete it.
CertUp example
Select the correct value in each list. To reach Azure SQL without a public endpoint, create a [private endpoint / service endpoint] and then set public network access to [Disabled / Enabled].
Show answer
Private endpoint and Disabled. The private endpoint gives the database a private address, and disabling public access closes the public route.
Read a description of a fictional company, then answer several questions that share the same background.
CertUp example
Fabrikam runs workloads in Azure and AWS and wants one view of its security posture. Which service should it use?
Show answer
A. Defender for Cloud can connect to AWS and show its posture next to Azure.
Complete tasks in a live environment by using the portal or code, and the exam checks the result.
CertUp example
Restrict a storage account so that it accepts requests only from one virtual network.
Show answer
Open the storage account's Networking page, allow access from selected virtual networks, add the virtual network and save.
Eligibility and booking
Sign in to Microsoft Learn with a personal Microsoft account, then schedule SC-500 with Pearson VUE from the certification page.
Make a study plan
Read the skills list, then work through one course while you build each control in your own Azure subscription. Give the AI security section extra time.
Most candidates spend 60–120 hours. Plan for the low end if you already hold AZ-500 or secure Azure workloads daily; plan for the high end if security is new to you, and add time for the AI security section.
- 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.4 h
- 3Learn the core conceptsWork through one main course or book, topic by topic.48 h
- 4Practice with mock examsTake timed practice tests and review every mistake.24 h
- 5Prepare for exam dayBook the exam and check the ID and delivery rules.4 h
Learn the core concepts
Use one course for coverage and do the labs yourself. The AI security section needs its own study time.
Best free courseSC-500 course on Microsoft Learn
Best paid courseSC-500 Cloud & AI Security Engineer Associate HandsOn CourseBest purpose-built courseSC-500: Microsoft Cloud and AI Security Engineer Exam PrepWatch your lab costs. Defender plans, Sentinel and firewalls are billed by usage. Use a trial or a small subscription, set a budget alert and delete resources when you finish.
Practice with mock exams
Microsoft has no SC-500 practice assessment yet. Try the exam sandbox for the question types, then use a third-party question set and review each explanation.
See all 2 SC-500 practice tests →Are you ready?
- You can secure a PaaS service with private endpoints and explain the traffic path.
- You can choose the Defender for Cloud plan and policy for a workload.
- You can explain how Purview DSPM, Entra Agent ID and Defender for AI each protect an AI workload.
Prepare for exam day
Choose the checklist for your test-centre or online appointment.
Before going to the test centre
Before testing from home
- Bring a current government-issued ID whose name matches your certification profile.
- Arrive about 15 minutes early for check-in.
- Store your belongings as instructed.
- Run the OnVUE system test on the same computer, network and room.
- Use a private room with the door closed and a clear desk. Unplug extra monitors.
- Check in from 30 minutes before your appointment. Check-in takes about 15 minutes.
- Keep your phone out of reach but nearby for check-in photos.
- Keep time for a lab and the case study. You cannot return to them once you move on.
- Lab exams take about 30 minutes to score, so your result may not appear straight away.
Advice from exam takers
Expect long scenario questions.
A beta taker describes paragraph-heavy questions and two case studies, finishing with four minutes left.
Be ready for a lab.
One August 2026 passer who scored 825 describes a seven-task lab that took about 15 to 20 minutes.