The score screen said 688. Pass mark is 700. I missed the AZ-500 by twelve points, which when you're staring at it feels exactly like missing it by one. I'd studied for six weeks. I'd done the labs. And I still walked out short, because I made one strategic mistake that I see other people about to make too.
Let me tell you what it was, so you don't repeat it.
The mistake: I studied the AZ-500 like a security exam, not an Azure exam
I came from a security background. I knew my threat models, my encryption concepts, my zero-trust principles. So when I started prepping, I leaned into the stuff I was already good at — the concepts — and skimmed the parts that were "just Azure clicking around."
That was the trap. The AZ-500 is not a conceptual security exam. It's an implementation exam. It doesn't ask "what is least privilege." It asks "which exact Azure RBAC role would you assign, and at which scope, to give this team the minimum access to manage Key Vault secrets but not keys." The concept I knew cold. The specific role name and scope behavior I'd hand-waved. And there are a lot of those questions.
What the exam actually is
For context, the AZ-500 is around 40 to 60 questions, 120 minutes, $165, pass mark of 700. Four domains, and the weighting is fairly even, which matters — there's no domain you can safely skip. Roughly:
- Manage identity and access (~25-30%) — Entra ID, conditional access, PIM, RBAC, managed identities.
- Secure networking (~20-25%) — NSGs, Azure Firewall, private endpoints, DDoS, WAF.
- Secure compute, storage, and databases (~20-25%) — VM security, disk encryption, storage account security, SQL security.
- Manage security operations (~25-30%) — Microsoft Defender for Cloud, Sentinel, Key Vault, policy.
Notice how operational and identity-heavy that is. The "pure security theory" you can bring from outside Azure is maybe 20% of your score. The other 80% is knowing exactly where the button is and what it does.
Where I bled points the first time
When I got my score breakdown, the weak domains were obvious in hindsight:
Identity and access. I lost the most here, which is humiliating for a security person. Conditional access policy specifics — what each condition and grant control actually does — got me. So did Privileged Identity Management: the difference between eligible and active assignments, activation, access reviews. I knew the idea of just-in-time access; I didn't know how PIM implements it. The exam wanted the implementation.
Security operations. Microsoft Defender for Cloud and Sentinel have a ton of moving parts — secure score, regulatory compliance, just-in-time VM access, the workbooks and analytics rules in Sentinel. I'd read about them. I hadn't clicked through them. Reading isn't the same as knowing where things live.
What I changed for attempt two
I rebuilt my entire approach around one rule: every concept must be tied to the specific Azure feature that implements it. No more "I understand network security." Instead: "I can configure an NSG rule, I know how Azure Firewall differs from an NSG, I know when you'd use a private endpoint versus a service endpoint."
Concretely:
I lived in the portal. For every topic, I went and configured the actual thing — created a conditional access policy, set up PIM eligibility, turned on Defender plans, built a Key Vault access policy and the newer RBAC-based access. Muscle memory beats notes here.
I drilled the comparison pairs. AZ-500 loves "A vs B" decisions: NSG vs Azure Firewall, service endpoint vs private endpoint, Key Vault access policy vs RBAC, Defender for Cloud vs Sentinel. I made a flashcard for every pair and the scenario that picks each one.
I treated identity as the main event. It's the biggest domain and it was my worst. I gave it the most hours the second time — conditional access conditions and controls, PIM end to end, managed identities (system vs user-assigned), and RBAC scope inheritance.
I changed how I used practice questions. First time, I used them to feel good. Second time, I used them to feel bad — hunting specifically for the topics I got wrong and going back to the portal to actually do them. A free AZ-500 practice test became my diagnostic, not my pep talk. Every wrong answer was a portal task I owed myself before the weekend was out.
Attempt two: 824
Same six weeks of total effort, redistributed. I poured time into the implementation details I'd skipped and the identity domain I'd underrated, and the score jumped from 688 to 824. Not because I got smarter about security — because I got specific about Azure.
The lesson, if you take nothing else
The AZ-500 punishes people who know security but not Azure, and it equally punishes Azure people who know the portal but not the security reasoning behind it. You need both, married together. Every principle has a feature; every feature implements a principle. Study them as pairs.
If you're coming from security like I did, your weak spot is the implementation specifics — go click everything. If you're coming from Azure infra, your weak spot is why — go understand the threat each control addresses. Either way, the gap is the marriage of the two.
I keep my comparison-pair cheat sheet and the identity-domain notes on ExamCert and reviewed them the morning of attempt two, because under exam pressure the RBAC roles and Defender plans start to swim together. Twelve points is a heartbreakingly small margin. Close it by getting specific. Don't do what I did the first time.
Top comments (0)