SC-500 study guide · 2026

The 4 SC-500 domains, explained

4 domains and 12 official functional groups. Secure storage, databases, and networking carries the most weight at 25–30%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 2 See all domains
Questions
40–60 (varies)
Time
120 minutes
Passing score
700 / 1000
Outline
SC-500 skills measured, published May 2026 (current)

Exam blueprint

Bar widths follow the official weights, scaled to fit the bar. Weight ranges are drawn at their midpoint.

  1. 1 20–25%
  2. 2 25–30%
  3. 3 20–25%
  4. 4 20–25%
  1. 1 Manage identity, access, and governance
  2. 2 Secure storage, databases, and networking
  3. 3 Secure compute
  4. 4 Manage and monitor security posture

All 4 domains

12 official functional groups 85–125 hrs suggested study

  1. Domain 01 20–25%

    Manage identity, access, and governance

    This group sets the identity and governance foundation for the SC-500 exam. It covers securing access with Microsoft Entra ID, protecting secrets and keys with Azure Key Vault, and enforcing security and compliance through governance controls.

    Inside this domain

    • Secure access to resources by using Microsoft Entra ID
    • Secure secrets and keys by using Azure Key Vault
    • Implement governance to enforce security and regulatory compliance

    Watch for Store the secret

    Functional groups
    3
    Questions est.
    9–14
    Study time est.
    20–30 hrs
  2. Domain 02 25–30%

    Secure storage, databases, and networking

    This is the heaviest SC-500 group. It covers securing data and the network it travels on: storage account security and Defender for Storage, Azure SQL security and auditing, and network controls from NSGs and private endpoints to Azure Firewall.

    Inside this domain

    • Implement security for storage accounts
    • Implement security for databases
    • Implement security for Azure network services

    Watch for Service endpoint for isolation

    Functional groups
    3
    Questions est.
    11–16
    Study time est.
    25–35 hrs
  3. Domain 03 20–25%

    Secure compute

    This group covers protecting everything that runs workloads, and it holds the single biggest change from AZ-500: a full AI security sub-domain. It also covers servers and virtual machines, and application platform services from containers to App Service.

    Inside this domain

    • Implement security for AI
    • Implement security for servers and virtual machines (VMs)
    • Implement security for application platform services

    Watch for Block the AI

    Functional groups
    3
    Questions est.
    9–14
    Study time est.
    20–30 hrs
  4. Domain 04 20–25%

    Manage and monitor security posture

    This group brings the whole environment together for monitoring and response. It covers managing posture with Defender for Cloud, collecting activity and events into Microsoft Sentinel, and implementing Microsoft Security Copilot.

    Inside this domain

    • Manage security posture by using Defender for Cloud
    • Implement activity and event collection in Microsoft Sentinel
    • Implement Microsoft Security Copilot

    Watch for Plan for compliance

    Functional groups
    3
    Questions est.
    9–14
    Study time est.
    20–30 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 85–125 hrs of study.

  1. 2 Secure storage, databases, and networking 25–30% · 25–35 hrs
  2. 1 Manage identity, access, and governance 20–25% · 20–30 hrs
  3. 3 Secure compute 20–25% · 20–30 hrs
  4. 4 Manage and monitor security posture 20–25% · 20–30 hrs

Try one

Practice questionDomain 2: Secure storage, databases, and networking

A company must ensure its Azure SQL Database protects specific columns of personal data so that even database administrators cannot read the plaintext values. Which feature should the security engineer implement?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Store the secret

    Clue The resource is an Azure service that supports managed identities.

  • Domain 2

    Service endpoint for isolation

    Clue The requirement is no public internet exposure or a private IP.

  • Domain 3

    Block the AI

    Clue The concern is Copilot surfacing overshared data.

  • Domain 4

    Plan for compliance

    Clue The requirement is to assess or track compliance against a framework.

Other Cybersecurity certifications

Study guides for exams that overlap with SC-500.

Practise what you read

SC-500 domains: common questions

How many domains are in the SC-500 exam?

SC-500 has 4 domains with 12 official functional groups between them: Manage identity, access, and governance, Secure storage, databases, and networking, Secure compute and Manage and monitor security posture.

Which SC-500 domain carries the most weight?

Secure storage, databases, and networking is the heaviest at 25–30%, followed by Manage identity, access, and governance (20–25%). The lightest is Manage and monitor security posture (20–25%). Weights come from Microsoft's official outline.

What is the SC-500 exam format?

Questions: 40–60 (varies). Time allowed: 120 minutes. Passing score: 700 / 1000.

How long should I study for SC-500?

Our planning estimate is 85–125 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Secure storage, databases, and networking, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows SC-500 skills measured, published May 2026 (current), published by Microsoft. It was last reviewed in October 2026.

Domain names, weights and functional groups come from Microsoft's official outline (SC-500 skills measured, published May 2026 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.