AZ-500
AZ-500 is an intermediate Azure certificate, proving you understand how to ensure and engineer the security of Azure. This is a step into the world cloud security. Studying and successfully passing this exam allows you to grasp the different security offerings of Azure and go more in-depth. After this exam, you have several options. I plan on preceding to the newly minted SC-100 Cybersecurity Architect exam, an expert level exam showcasing you understand how to build and manage the cloud security of an organization.
The AZ-500 exam focuses on the following domains:
Manage identity and access (25–30%)
Secure networking (20–25%)
Secure compute, storage, and databases (20–25%)
Manage security operations (25–30%)
Just like the AZ-900 exam, many free tools exist but I will link my personal favorites. However, you will find fewer resources related to the AZ-500 exam compared to AZ-900, so take your time going through any resources. The goal is to be able to bring the concepts together in your head, and try to see how you can apply it in a real-world example. Once you can explain the concept to yourself without the frustation of being confused, you are heading the right direction.
The free resources will include Microsoft Learning and John Savill's YouTube. John Savill is a saint in the Microsoft world and provides a lot of free material that others would charge hundreds for. Take advantage!
Regarding paid tools, I did pay for WhizLabs as it allows for an Azure sandbox, along with practice labs and questions, allowing you to gain hands-on experience without having to pay for Azure directly.
As a student you can open a free Azure account with $200 in credits for you to use. This is a great tool to get hands-on experience.