Azure AZ-500 study plan

Stand up a lab Microsoft Entra tenant with three users, one assigned security group, and one dynamic group, then verify dynamic membership evaluation on a test attribute change

Enable Security Defaults, then replace them with two Conditional Access policies: one blocking legacy authentication and one requiring MFA for all users with a break-glass exclusion

Create three named locations and mark the corporate range as trusted, then confirm how the trusted-location condition changes MFA prompts in sign-in logs

Configure self-service password reset with two authentication methods and write down the exact method requirements each policy enforces

Configure Privileged Identity Management for the Global Administrator and User Access Administrator roles, including approval, MFA on activation, and a 2-hour maximum duration

Create a custom Azure RBAC role scoped to a single resource group with only the actions needed for a read-and-restart workload, and verify it with the least-privilege test account

Register an application, grant a delegated Microsoft Graph permission with admin consent, and compare it against an app-only permission assignment on the same registration

Replace a stored client secret with a system-assigned managed identity on a lab virtual machine and confirm the token acquisition works without credentials

Enumerate all standing role assignments across the subscription and identify at least two that should be converted to eligible PIM assignments

Build a network security group rule set using application security groups so that only a tagged web tier can reach a tagged database tier on a single port, then prove the deny path with a connectivity test

Deploy a private endpoint for a storage account, disable public network access, and resolve the private IP from a virtual machine using a linked private DNS zone

Configure Azure Firewall with a policy containing one application rule, one network rule, and one DNAT rule, and verify traffic through each path

Enable Azure Bastion on a subnet and remove the public IP from a lab virtual machine to confirm management access still works

Associate a DDoS Network Protection plan with a virtual network and review the protection status and telemetry for that network

Peer a hub virtual network to two spoke networks with gateway transit enabled, then document the effective routes that result on each spoke

Configure a site-to-site VPN gateway connection and verify tunnel status and shared key rotation steps without breaking the connection

Enable virtual network flow logs and NSG flow logs into a Log Analytics workspace, then write one KQL query that surfaces denied flows

Run Network Watcher connection troubleshoot and IP flow verify against the database tier and record the verdict output for a failing and a passing case

Configure Azure Key Vault firewall and private endpoint together and confirm a public client is denied while a private client succeeds

Create a customer-managed disk encryption set backed by Key Vault and attach it to a new virtual machine, then confirm the OS and data disks report the DES encryption state

Enable Microsoft Defender for Servers just-in-time VM access on a lab machine and open a port through an approved request with a limited time window

Apply Azure Policy guest configuration to a virtual machine to audit a security baseline setting and force a remediation task on a non-compliant resource

Harden an AKS cluster by enabling the Azure Policy add-on, a network policy, and workload identity, then assign a Pod that reaches Key Vault without a secret

Enable trusted launch or confidential disk encryption on a new virtual machine and record which OS and region combinations support it

Configure a Key Vault with soft delete, purge protection, and Azure RBAC permission model, then demonstrate that the access policy model no longer grants data-plane access

Generate a storage account shared access signature scoped to one container with a stored access policy, then revoke access by deleting the policy before the SAS expiry

Enable customer-managed keys for a storage account using a Key Vault key and rotate the key version to confirm re-encryption of the account

Turn on Microsoft Defender for SQL and configure auditing plus Transparent Data Encryption with a customer-managed key on an Azure SQL database

Apply Always Encrypted to one column in an Azure SQL table and verify the column data is unreadable from a client without the column encryption key

Enable the relevant Microsoft Defender for Cloud plans across the subscription and raise the secure score by remediating at least three recommendations through the fix-it and manual paths

Configure continuous export of Defender for Cloud alerts and recommendations into a Log Analytics workspace and confirm ingestion with a KQL query

Create a Sentinel workspace, connect Microsoft Entra ID and Azure Activity data connectors, and validate that sign-in and activity events arrive

Author two analytics rules in Microsoft Sentinel - one scheduled rule and one Microsoft security rule - and trigger each to create a genuine incident

Build an automation rule and a playbook that assigns and tags a new incident, then execute the playbook against a test incident

Retake every missed practice question from weeks 4 and 6 and write a corrected explanation for each one in your own words

Complete two full-length timed practice exams under exam conditions and compare per-domain scores to locate the two weakest objectives

Remediate the two weakest objectives with targeted labs and re-test only those objectives until each scores above 80 percent

Assemble a single-page reference sheet covering Conditional Access design, private endpoint versus service endpoint, key management, and Sentinel rule types

Review the identity and networking guardrails one final time, since those two domains account for half of the exam weight