AZ-500 Domain 3: Secure compute, storage, and databases (20-25%) - Complete Study Guide 2026

Domain 3 Overview: Why This Slice of AZ-500 Matters

Domain 3, officially titled "Secure compute, storage, and databases," represents 20-25% of the AZ-500 exam - tied with Domain 2 (secure networking) as the second-largest content area behind Domain 4's 30-35% weighting on Microsoft Defender for Cloud and Microsoft Sentinel. If you're mapping out your prep across all four areas, this domain sits right in the middle of the workload: not as identity-heavy as Domain 1, not as sprawling as Domain 4, but dense with hands-on configuration knowledge that examiners love to test through scenario-based questions.

Unlike Domain 1's focus on Microsoft Entra ID or Domain 2's focus on network security groups and firewalls, Domain 3 asks you to secure the actual workloads and data stores running inside Azure - virtual machines, containers, storage accounts, and both relational and NoSQL databases. If you haven't yet reviewed how this domain fits alongside the others, the AZ-500 Exam Domains 2026 guide breaks down all four content areas side by side.

Securing Compute: VMs, Containers, and Serverless

Compute security questions on AZ-500 typically revolve around three workload types: Azure Virtual Machines, container platforms (Azure Kubernetes Service and Azure Container Instances), and serverless/PaaS compute like App Service and Azure Functions. Each has distinct security controls you need to know cold.

Serverless compute security is smaller in weight but still shows up - expect at least one item on App Service authentication (easy auth), managed identities for Functions, and restricting access via private endpoints or access restrictions rather than public inbound rules.

Securing Storage Accounts and Data at Rest

Storage account security is one of the most testable areas in Domain 3 because Azure Storage has so many overlapping controls: shared access signatures, access keys, network rules, encryption scopes, and immutability policies. AZ-500 questions frequently present a scenario where multiple controls could technically work, and you must pick the most secure or most appropriate one given stated constraints.

• Shared Access Signatures (SAS): Know the difference between account SAS, service SAS, and user delegation SAS, and why user delegation SAS (backed by Microsoft Entra ID) is generally preferred over account-key-based SAS.
• Storage firewalls and private endpoints: Restricting storage account access to specific virtual networks or private endpoints instead of relying on public endpoint allow-lists.
• Encryption at rest: Microsoft-managed keys by default, with customer-managed keys in Key Vault for stricter compliance requirements.
• Access key rotation and Azure Storage RBAC: When to disable access keys entirely and enforce Microsoft Entra ID-based authorization instead.
• Immutable blob storage and soft delete: Protecting data from accidental or malicious deletion, a topic that overlaps with Domain 4's data protection concerns.

Securing Azure SQL, Cosmos DB, and Managed Databases

Database security in Domain 3 spans Azure SQL Database, Azure SQL Managed Instance, and Azure Cosmos DB, with occasional coverage of Azure Database for PostgreSQL/MySQL. This is where identity, network, and data protection concepts you learned in earlier domains converge.

Expect at least one question combining database auditing configuration with Microsoft Defender for Cloud alerting - this is a deliberate overlap point since Domain 4 covers the detection side while Domain 3 covers the configuration side. Understanding this handoff between domains is exactly why reviewing the Domain 4 study guide alongside this one pays off, since Defender for Cloud recommendations frequently reference the same database and storage settings tested here.

How Domain 3 Questions Are Actually Written

AZ-500 doesn't publish an exact scored question count, but candidates typically see 40-60 items across all domains within the 100-minute exam window, mixing standard multiple-choice with case studies and interactive lab-style tasks. Domain 3 questions tend to follow a few recognizable patterns:

• Scenario-first, requirement-buried: A paragraph describes an organization's compute or storage setup, then buries a specific compliance or performance constraint that determines the correct answer.
• "Choose the minimal change" framing: Given an existing configuration, which single change satisfies a new requirement without breaking existing functionality - testing whether you understand dependencies between services.
• Drag-and-drop or ordered steps: Some interactive items ask you to sequence configuration steps, such as setting up customer-managed key encryption for a storage account (create Key Vault, assign managed identity, grant key permissions, then configure the storage account).
• Case studies: Longer scenarios spanning multiple questions where earlier answers about compute or networking constrain later database or storage decisions.

Because the exam is proctored with split-pane access to Microsoft Learn documentation, you're not expected to memorize every CLI flag or portal menu path. What you do need is enough conceptual fluency to know which doc to search and evaluate answer choices quickly - spending too long searching docs mid-exam eats into your 100 minutes fast. For a broader breakdown of exam mechanics and difficulty expectations, see How Hard Is the AZ-500 Exam?.

Scheduling Domain 3 Inside Your AZ-500 Study Plan

Because Domain 3 shares roughly the same weight as Domain 2 (20-25% each), many candidates study them back-to-back since compute and storage security constantly reference networking controls like private endpoints and VNet integration. A simple way to sequence a multi-week plan:

If you're building your full study calendar from scratch, the AZ-500 Study Guide 2026 lays out a complete week-by-week template covering all four domains, not just this one. And if you haven't reviewed Domain 1's identity and access content yet, doing so before Domain 3 helps because managed identity concepts introduced there reappear constantly in VM, storage, and database security discussions here.

Who Hires for These Skills

Domain 3 competencies map directly to day-to-day responsibilities for cloud security engineers, cloud infrastructure administrators, and DevSecOps roles working in Azure-heavy environments. Organizations running production workloads on Azure VMs, AKS clusters, or Azure SQL databases need someone who can configure encryption, access controls, and network isolation correctly the first time - not after an audit finding. Employers posting roles that reference AZ-500 typically expect candidates to already be comfortable with the compute, storage, and database controls this domain covers, alongside the identity and networking material in Domains 1 and 2.

If you're evaluating whether this credential fits your career goals, the AZ-500 Jobs overview and AZ-500 Salary Guide 2026 both discuss how this specific skill set gets used in real hiring contexts, and Is the AZ-500 Certification Worth It? weighs the broader ROI question given the exam's August 31, 2026 retirement date.

Common Mistakes Candidates Make on This Domain

• Treating storage and database encryption as one topic: They share concepts (customer-managed keys, Key Vault) but have distinct configuration paths - conflating them causes wrong answers on detail-heavy questions.
• Ignoring container security until the last week: AKS and container registry topics are smaller in volume but still tested; skipping them entirely risks losing easy points.
• Forgetting the Microsoft Entra ID connection: Nearly every compute, storage, and database control in Domain 3 has an identity-based alternative to key-based access - the exam rewards knowing when to prefer identity over keys/secrets.
• Not practicing under time pressure: With roughly 40-60 items in 100 minutes across all four domains, spending too long parsing dense Domain 3 case studies can crowd out time for Domain 4, which carries the highest weight.

Running full-length timed practice sessions on our AZ-500 practice test platform is one of the more reliable ways to catch these habits before exam day, since it forces the same pacing discipline the real 100-minute window demands. If you're also curious how your prep timeline compares to typical outcomes, AZ-500 Pass Rate 2026: What the Data Shows and AZ-500 Certification Cost 2026 round out the practical planning picture alongside registration mechanics through Pearson VUE at the standard USD 165 fee (with regionalized pricing shown at checkout).

FAQ