Certification guide
The Microsoft SC-500 exam earns the Microsoft Certified: Cloud and AI Security Engineer Associate credential, the associate-level security certification that replaces AZ-500, retired August 31, 2026, and folds in the AI-security work that used to live scattered across specialty exams. It validates that you can design and operate security controls across Microsoft Entra, Azure, Microsoft 365, and the AI stack (Azure OpenAI, Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot).
SC-500 replaces AZ-500 (retired August 31, 2026) as Microsoft’s associate-level security engineering credential, expanding scope beyond Azure alone to cover the full lifecycle a modern security engineer touches: identity and governance, data-plane security for storage/databases/networking, compute security (including confidential computing and AI-workload security), and posture management with Microsoft Defender for Cloud and Microsoft Sentinel. The credential is renewed annually for free via an online assessment on Microsoft Learn.
Exam · SC-500 Level · Associate Format · ~40-60 items Time · 100 min working Pass · 700 / 1000 Cost · $165 USD Renewal · Free, yearly Prereq · None (SC-900 recommended)
Manage identity, access, and governance
Domain 1 · 20-25%Microsoft Entra ID identity protection, Conditional Access with authentication strengths (phishing-resistant MFA, multifactor, passwordless), Privileged Identity Management for just-in-time role activation with approval workflows, workload identities and Entra Agent ID for AI-agent identity governance, Continuous Access Evaluation, Entra ID Governance access reviews and access packages, Azure RBAC and ABAC with condition builder, Azure Policy at management-group scope with restricted exemption rights, and Microsoft Purview data governance touchpoints. The domain sets the identity foundation every other domain builds on, an admin-role misassignment tends to blow up every other control in the chain.
Secure storage, databases, and networking
Domain 2 · 25-30%The heaviest domain. Storage account hardening (private endpoints, disabled shared-key access, disabled anonymous access, TLS 1.2 minimum, CMK in Key Vault or Managed HSM), immutable blob storage with locked time-based retention policies, Azure Files authentication modes (AD DS, Entra Kerberos, Entra Domain Services), Azure SQL Database and Managed Instance security (Always Encrypted with secure enclaves, Defender for SQL, TDE with CMK), Cosmos DB CMK and private endpoints, Azure Firewall Premium with IDPS in Alert-and-deny mode and TLS inspection, Azure Virtual Network Manager security admin rules that supersede subnet NSGs, Azure Front Door Premium WAF with bot protection and rate limiting, Azure Application Gateway WAF, private endpoints and Private Link Service for partner-tenant access, ExpressRoute encryption (MACsec at L2 on ER Direct ports, IPsec-over-ER at L3), and Azure DNS Private Resolver for hybrid resolution.
Secure compute (including AI workloads)
Domain 3 · 20-25%Where SC-500 diverges most from the SOC-analyst track (SC-200, which continues). Microsoft Defender for Endpoint with direct-sensor onboarding, Defender for Servers Plans 1 and 2 (Plan 2 unlocks agentless machine scanning, full MDVM, and JIT VM access), Azure Bastion Premium with session recording to a Log Analytics workspace, Just-In-Time VM access replacing scheduled NSG jobs, Trusted Launch VMs with Secure Boot and vTPM measuring the boot chain, Azure Confidential Computing VMs on AMD SEV-SNP or Intel TDX for memory-encrypted TEE workloads, Azure Machine Configuration on Arc machines applying Defender for Cloud baselines, Azure Container Registry supply-chain security with content trust and signed-image admission policy, AKS ingress and egress control (internal-only environments, private endpoints for ACR, kubelet identity with AcrPull), and the AI-security stack: Microsoft Defender for AI Service for prompt-injection and credential-leak detection, Purview Data Security Posture Management (DSPM) for AI to surface oversharing before broad Copilot rollout, Purview real-time protection for Copilot Studio, Foundry content filters and safety systems with custom categories, Azure API Management LLM policies (llm-token-limit, llm-emit-token-metric) as an AI gateway, and Entra Agent ID with Conditional Access for workload identities to govern AI-agent sign-in.
Manage and monitor security posture
Domain 4 · 20-25%Microsoft Defender for Cloud secure score, Foundational vs. paid Defender CSPM (paid unlocks attack path analysis, agentless secret scanning, and sensitive data discovery), the regulatory compliance dashboard and adding standards like NIST SP 800-53 R5, ISO 27001, HIPAA HITRUST, PCI DSS 4.0, and NIST 800-171, Defender EASM for external attack surface discovery of forgotten public assets, MDVM findings across endpoints and servers, multicloud onboarding via the AWS connector (CloudFormation stack + STS role) and GCP connector, Microsoft Sentinel workspace design for multi-region residency with Azure Lighthouse projecting cross-workspace query rights, Sentinel roles (Responder for triage, Contributor for rule authoring, Reader for read-only), Content hub solutions bundling connectors and analytic rules, Azure Monitor Agent with data collection rules replacing the retired Log Analytics agent, Sentinel automation rules for incident-creation actions and playbooks with managed-identity authentication, Sentinel interactive vs. archive retention with Search jobs for long-tail queries, Defender XDR Advanced Hunting across the AuditLogs schema, Microsoft Security Copilot workspaces provisioned with Security Compute Units (SCUs), and Microsoft Security Store agents that run inside Copilot workspaces and consume SCU capacity.
Practice with the Certifym.net SC-500 bank at scale: 1,000 unique scenario-based items rotating through ten industry verticals (generic enterprise, healthcare with HIPAA, financial services under PCI DSS 4.0 and SOX, manufacturing/OT with ISA/IEC 62443 and the Purdue model, federal/government at FedRAMP High and DoD IL4/5 with NIST 800-53 and CMMC, retail/e-commerce with PCI and account-takeover scenarios, SaaS multi-tenant with SOC 2 Type II and Azure Lighthouse, higher education with FERPA and CUI research, energy/utilities under NERC CIP and TSA pipeline directives, and telecom with 5G Core, MEC, and CALEA). Simulator mode draws 60 random questions per attempt, the top of Microsoft’s published ~40-60 item count, so each sitting feels like the real exam. Aim for 75% or better on repeated draws before booking. That’s an honest raw-score equivalent that gives you headroom against the scaled-score conversion (Microsoft’s 700/1000 pass mark is roughly a 65-70% raw threshold), and you want to be scoring well above it consistently, not because the exam is trivial but because you want the buffer for the two or three items that hit an unfamiliar angle, not luck in the heavy ones.
Microsoft Cloud and AI Security Engineer Associate — Practice Exam
Practice bank for the Microsoft SC-500 (Cloud and AI Security Engineer Associate) exam from Certifym.net. Over 1,000 unique scenario-based items across the four official Microsoft Learn…
Subscribe to startFrequently asked questions about SC-500
What is the Microsoft SC-500 exam?
SC-500 is the exam that earns the Microsoft Certified: Cloud and AI Security Engineer Associate credential. It validates that you can design and operate security controls across Microsoft Entra, Azure, Microsoft 365, and the AI stack: Azure OpenAI, Copilot Studio, Microsoft Foundry, and Microsoft 365 Copilot.
How many questions are on SC-500 and how long is the exam?
Microsoft publishes an item count of roughly 40-60 questions, with 100 minutes of working time.
What is the passing score for SC-500?
700 out of 1000 on Microsoft’s scaled scoring system. That is not a raw percentage, as a working equivalent, 700/1000 corresponds to roughly a 65-70% raw threshold, which is why aiming for 75% or better on practice draws gives you headroom.
How much does the SC-500 exam cost?
$165 USD.
Are there prerequisites for SC-500?
There are no formal prerequisites. SC-900 (Security, Compliance, and Identity Fundamentals) is recommended as a starting point before attempting SC-500.
What domains does SC-500 cover, and how are they weighted?
Four domains: Manage identity, access, and governance (20-25%); Secure storage, databases, and networking (25-30%); Secure compute, including AI workloads (20-25%); and Manage and monitor security posture (20-25%). Storage, databases, and networking is the heaviest domain, so it should absorb the most study time.
How long is the certification valid, and how do I renew it?
The credential is renewed annually, for free, via an online assessment on Microsoft Learn.
How is SC-500 different from SC-200?
They are different jobs, and SC-500 does not replace SC-200. SC-500 replaced AZ-500 (retired August 31, 2026) as Microsoft’s associate-level security engineering credential: designing and operating controls across identity and governance, data-plane security for storage, databases and networking, compute security including confidential computing and AI workloads, and posture management with Microsoft Defender for Cloud and Microsoft Sentinel, folding in AI-security work that used to be scattered across specialty exams. SC-200 continues as the SOC-analyst credential, focused on detection, investigation, and response. Engineers build and harden the estate; analysts run the fight inside it.
What AI-security topics does SC-500 test?
They sit mostly in the compute domain: Microsoft Defender for AI Service for prompt-injection and credential-leak detection, Purview Data Security Posture Management (DSPM) for AI to surface oversharing before a broad Copilot rollout, Purview real-time protection for Copilot Studio, Foundry content filters and safety systems with custom categories, Azure API Management LLM policies such as llm-token-limit and llm-emit-token-metric used as an AI gateway, and Entra Agent ID with Conditional Access to govern AI-agent sign-in.
How should I prepare for SC-500?
Work scenario-based items at volume. The Certifym.net SC-500 bank holds 1,000 unique scenario questions rotating through ten industry verticals, and simulator mode draws 60 random questions per attempt, the top of Microsoft’s published ~40-60 item count, so each sitting feels like the real exam. Aim for 75% or better on repeated draws before booking.
Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. “Microsoft,” “Microsoft Certified,” “Azure,” “Microsoft Entra,” “Microsoft Defender,” “Microsoft Sentinel,” “Microsoft Purview,” “Microsoft 365,” “Copilot,” and related names, marks, and logos are trademarks or registered trademarks of Microsoft Corporation in the United States and/or other countries. Exam codes referenced (including SC-500, SC-900, AI-102, AI-103, AZ-104, AZ-500, and SC-100) are used solely for descriptive and study-aid purposes. The SC-500 exam objectives are the property of Microsoft; candidates should always confirm the current skills outline, weightings, and logistics directly on Microsoft Learn before scheduling. All other trademarks are the property of their respective owners.
All practice questions, explanations, and study materials on Certifym.net are original content authored by Certifym Exam Services, LLC. Content is aligned to the publicly available Microsoft Learn exam skills outline for SC-500 and does not reproduce official Microsoft exam questions, question banks, or copyrighted training material. Passing our practice tests does not guarantee passing the official Microsoft SC-500 exam.