AZ-500
Microsoft Azure Security Technologies exam.
Getting Started: AZ-500 Exam Overview
Free knowledge base
Microsoft Certified: Azure Security Engineer Associate — key terms, tricks & tips
Everything from the course in one searchable place: 238 entries. Use it to review before a practice test or look up a word you forgot.
238 results
Functional Group
A major section or domain of the exam objectives.
Getting Started: AZ-500 Exam Overview
Weighting
Percentage indicating importance of a domain on the exam.
Getting Started: AZ-500 Exam Overview
Scaled Score
Exam score adjusted for question difficulty.
Getting Started: AZ-500 Exam Overview
Microsoft Entra ID
Microsoft's cloud-based identity and access management service.
Getting Started: AZ-500 Exam Overview
RBAC
Role-Based Access Control, managing permissions.
Getting Started: AZ-500 Exam Overview
Microsoft Defender for Cloud
Unified security management and threat protection.
Getting Started: AZ-500 Exam Overview
Microsoft Sentinel
Cloud-native SIEM for security analytics.
Getting Started: AZ-500 Exam Overview
Understanding the AZ-500 Exam Structure and Objectives
Imagine a secure 'ID' (Identity) guarding a 'PLATFORM' (Platform Protection) which holds your 'DATA' (Secure Data & Applications), all while a 'COP' (Security Operations) watches over everything.
Getting Started: AZ-500 Exam Overview
Understanding the AZ-500 Exam Structure and Objectives
Memorize the four main functional groups and their approximate weightings. The exact percentages might shift slightly, but the relative importance of each domain (e.g., Identity and Security Operations being slightly higher) is a common exam pattern.
Getting Started: AZ-500 Exam Overview
Understanding the AZ-500 Exam Structure and Objectives
Underestimating the importance of hands-on lab practice for each domain.
Getting Started: AZ-500 Exam Overview
Understanding the AZ-500 Exam Structure and Objectives
Focusing too heavily on one domain while neglecting others, especially lower-weighted ones.
Getting Started: AZ-500 Exam Overview
Understanding the AZ-500 Exam Structure and Objectives
Not checking the official Microsoft exam page for the latest objective updates before starting your study.
Getting Started: AZ-500 Exam Overview
Azure Free Account
Microsoft's offering for new users to explore Azure services.
Getting Started: AZ-500 Exam Overview
Resource Group
A logical container for Azure resources.
Getting Started: AZ-500 Exam Overview
Virtual Network (VNet)
An isolated network in Azure for your resources.
Getting Started: AZ-500 Exam Overview
Network Security Group (NSG)
A set of security rules that allow or deny network traffic.
Getting Started: AZ-500 Exam Overview
Azure Cost Management
Tools to monitor, allocate, and optimize Azure spending.
Getting Started: AZ-500 Exam Overview
Deallocate
To stop a VM and release its allocated resources.
Getting Started: AZ-500 Exam Overview
Azure Sandbox
Temporary, free environments for specific Microsoft Learn exercises.
Getting Started: AZ-500 Exam Overview
Setting Up Your Azure Lab Environment for Practice
FREE LAB: F-Free account, R-Resources, E-Estimate costs, E-Eliminate unused. L-Least privilege, A-Azure AD, B-Budgets.
Getting Started: AZ-500 Exam Overview
Setting Up Your Azure Lab Environment for Practice
The AZ-500 exam expects you to understand how to provision and manage Azure resources securely. Be familiar with the cost implications of various services, especially VMs and storage, and how to use Azure Cost Management tools.
Getting Started: AZ-500 Exam Overview
Setting Up Your Azure Lab Environment for Practice
Forgetting to deallocate or delete resources, leading to unexpected charges.
Getting Started: AZ-500 Exam Overview
Setting Up Your Azure Lab Environment for Practice
Using weak passwords or not enabling MFA in your lab, which creates bad habits.
Getting Started: AZ-500 Exam Overview
Setting Up Your Azure Lab Environment for Practice
Not utilizing Azure Budgets to monitor and control spending.
Getting Started: AZ-500 Exam Overview
Azure Active Directory
Microsoft's cloud-based identity and access management service.
Module 1: Managing Azure Identities and Access
User Principal Name (UPN)
Unique identifier for a user in Azure AD (e.g., user@domain.com).
Module 1: Managing Azure Identities and Access
Guest User
External user invited to an Azure AD tenant for collaboration.
Module 1: Managing Azure Identities and Access
Security Group
Azure AD group used to manage access to resources and applications.
Module 1: Managing Azure Identities and Access
Dynamic Group
Group whose membership is automatically managed based on rules.
Module 1: Managing Azure Identities and Access
Service Principal
Identity representing an application or service in Azure AD.
Module 1: Managing Azure Identities and Access
Managed Identity
Azure AD identity automatically managed for Azure services.
Module 1: Managing Azure Identities and Access
Azure AD Connect
Tool for synchronizing on-premises AD with Azure AD.
Module 1: Managing Azure Identities and Access
Managing Azure Active Directory Identities
Users, Groups, Apps, Services: UG-AS. Remember the four main types of identities you manage in Azure AD: Users, Groups, Applications (via Service Principals), and Services (via Managed Identities).
Module 1: Managing Azure Identities and Access
Managing Azure Active Directory Identities
The exam often tests your ability to distinguish between different identity types and their primary use cases. Pay close attention to the difference between Service Principals (for applications) and Managed Identities (for Azure services), and when to use Security Groups vs. Microsoft 365 Groups.
Module 1: Managing Azure Identities and Access
Managing Azure Active Directory Identities
Confusing a Service Principal with a Managed Identity: Service Principals are for applications you register, Managed Identities are for Azure services themselves.
Module 1: Managing Azure Identities and Access
Managing Azure Active Directory Identities
Assigning permissions directly to individual users instead of using groups: This creates administrative overhead and makes auditing difficult.
Module 1: Managing Azure Identities and Access
Managing Azure Active Directory Identities
Not understanding the difference between system-assigned and user-assigned Managed Identities.
Module 1: Managing Azure Identities and Access
Conditional Access
Policy engine for 'if-then' access control.
Module 1: Managing Azure Identities and Access
Multi-Factor Authentication (MFA)
Requires two or more verification factors for access.
Module 1: Managing Azure Identities and Access
Identity Protection
Detects, investigates, and remediates identity risks.
Module 1: Managing Azure Identities and Access
Sign-in Risk
Likelihood a sign-in isn't performed by the legitimate user.
Module 1: Managing Azure Identities and Access
User Risk
Likelihood an identity or account is compromised.
Module 1: Managing Azure Identities and Access
Report-only Mode
Tests Conditional Access policies without enforcing them.
Module 1: Managing Azure Identities and Access
Emergency Access Account
Account excluded from policies to prevent lockout.
Module 1: Managing Azure Identities and Access
Configuring Secure Access with Azure AD Features
CAFE: Conditions, Assignments, Forcing, Exclusions. Remember these steps when building a Conditional Access policy.
Module 1: Managing Azure Identities and Access
Configuring Secure Access with Azure AD Features
The exam heavily tests Conditional Access policies. Look for keywords like 'enforce MFA', 'block access from untrusted locations', 'require compliant device', or 'respond to risky sign-ins'. Know the components: assignments (users, apps, conditions) and access controls (grant/block, session controls).
Module 1: Managing Azure Identities and Access
Configuring Secure Access with Azure AD Features
Not testing Conditional Access policies in report-only mode before enforcing them, potentially locking out users.
Module 1: Managing Azure Identities and Access
Configuring Secure Access with Azure AD Features
Forgetting to create and exclude an emergency access account from all Conditional Access policies.
Module 1: Managing Azure Identities and Access
Configuring Secure Access with Azure AD Features
Overly broad Conditional Access policies that impact user productivity unnecessarily.
Module 1: Managing Azure Identities and Access
Application Object
Global representation of an application in Azure AD, defining its properties.
Module 1: Managing Azure Identities and Access
Application (client) ID
Unique identifier assigned to an application during registration.
Module 1: Managing Azure Identities and Access
Delegated Permissions
Permissions where an app acts on behalf of a signed-in user.
Module 1: Managing Azure Identities and Access
Application Permissions
Permissions where an app acts on its own, without a signed-in user.
Module 1: Managing Azure Identities and Access
Admin Consent
Permission granted by an administrator for an application to access resources.
Module 1: Managing Azure Identities and Access
Redirect URI
URL where Azure AD sends the authentication response after successful login.
Module 1: Managing Azure Identities and Access
Managing Application Access in Azure AD
App Object is the 'A'll-encompassing blueprint. Service Principal is the 'S'pecific instance in a tenant.
Module 1: Managing Azure Identities and Access
Managing Application Access in Azure AD
On the exam, distinguish clearly between an 'application object' (global, template) and a 'service principal' (tenant-specific instance). Keywords like 'multi-tenant application' or 'grant permissions within a specific tenant' often point to service principals.
Module 1: Managing Azure Identities and Access
Managing Application Access in Azure AD
Confusing application objects with service principals; they are distinct but related.
Module 1: Managing Azure Identities and Access
Managing Application Access in Azure AD
Forgetting to grant admin consent for application permissions, leading to access denied errors.
Module 1: Managing Azure Identities and Access
Managing Application Access in Azure AD
Not setting 'User assignment required?' to 'Yes' when granular access control is needed.
Module 1: Managing Azure Identities and Access
Role-Based Access Control (RBAC)
System for managing who has access to Azure resources.
Module 1: Managing Azure Identities and Access
Security Principal
The identity (user, group, service principal) granted access.
Module 1: Managing Azure Identities and Access
Role Definition
A collection of permissions specifying allowed actions.
Module 1: Managing Azure Identities and Access
Scope
The level (management group, subscription, resource group, resource) where access applies.
Module 1: Managing Azure Identities and Access
Role Assignment
Links a security principal, role definition, and scope.
Module 1: Managing Azure Identities and Access
Principle of Least Privilege
Granting only minimum necessary permissions.
Module 1: Managing Azure Identities and Access
Built-in Roles
Pre-defined Azure roles like Owner, Contributor, Reader.
Module 1: Managing Azure Identities and Access
Custom Roles
User-defined roles with specific, tailored permissions.
Module 1: Managing Azure Identities and Access
Implementing Azure Role-Based Access Control (RBAC)
Remember 'PRS' for RBAC: Principal, Role, Scope. It's like a 'Personal Record System' for who can do what, where!
Module 1: Managing Azure Identities and Access
Implementing Azure Role-Based Access Control (RBAC)
For the AZ-500, memorize the core components of a role assignment: Security Principal, Role Definition, and Scope. Understand that permissions are inherited down the hierarchy. Be prepared to identify the appropriate built-in role for common scenarios, and know when a custom role is necessary.
Module 1: Managing Azure Identities and Access
Implementing Azure Role-Based Access Control (RBAC)
Granting 'Owner' or 'Contributor' roles at the subscription level unnecessarily, violating least privilege.
Module 1: Managing Azure Identities and Access
Implementing Azure Role-Based Access Control (RBAC)
Forgetting that permissions are inherited, leading to unintended access at lower scopes.
Module 1: Managing Azure Identities and Access
Implementing Azure Role-Based Access Control (RBAC)
Not regularly auditing RBAC assignments, allowing stale or over-privileged access to persist.
Module 1: Managing Azure Identities and Access
Identity Governance
Managing identity and access lifecycles, auditing, and compliance.
Module 1: Managing Azure Identities and Access
Access Reviews
Periodically reviewing user access to resources and roles.
Module 1: Managing Azure Identities and Access
Entitlement Management
Automating access requests, approvals, and provisioning via access packages.
Module 1: Managing Azure Identities and Access
Access Package
A bundle of resources users can request access to in Entitlement Management.
Module 1: Managing Azure Identities and Access
Advanced Identity Protection and Governance
Imagine an 'ID PROTECTOR' superhero (Identity Protection) who spots 'RISKY SIGNS' (Sign-in Risk) and 'BAD USERS' (User Risk). He then calls the 'GOVERNOR' (Identity Governance) who does 'ACCESS REVIEWS' and manages 'ENTITLEMENTS' with 'ACCESS PACKAGES'!
Module 1: Managing Azure Identities and Access
Advanced Identity Protection and Governance
For the AZ-500 exam, precisely distinguish between user risk and sign-in risk policies. Know that Identity Protection feeds into Conditional Access. Remember that Access Reviews are for periodic re-evaluation, and Entitlement Management uses Access Packages for lifecycle management.
Module 1: Managing Azure Identities and Access
Advanced Identity Protection and Governance
Confusing user risk with sign-in risk; user risk is about the account itself, sign-in risk is about a specific login attempt.
Module 1: Managing Azure Identities and Access
Advanced Identity Protection and Governance
Not testing Identity Protection policies in report-only mode first, leading to accidental lockouts.
Module 1: Managing Azure Identities and Access
Advanced Identity Protection and Governance
Failing to implement access reviews, resulting in users retaining access to resources long after they need it.
Module 1: Managing Azure Identities and Access
Application Security Group (ASG)
Groups VMs for simplified NSG rule management.
Module 2: Implementing Azure Platform Protection
Azure Firewall
Managed, stateful network security service.
Module 2: Implementing Azure Platform Protection
DDoS Protection
Mitigates distributed denial of service attacks.
Module 2: Implementing Azure Platform Protection
Service Endpoint
Secures Azure service access from a VNet.
Module 2: Implementing Azure Platform Protection
Private Endpoint
Brings Azure services into your VNet privately.
Module 2: Implementing Azure Platform Protection
5-tuple
Source/dest IP, port, and protocol for traffic filtering.
Module 2: Implementing Azure Platform Protection
Implementing Network Security in Azure
NSG: 'N'ice 'S'ecurity 'G'uard for your VM's door. ASG: 'A'pplication 'S'ecurity 'G'roups make rules 'A'll 'S'imple and 'G'ood. Firewall: 'F'ilters 'I'nternet 'R'equests 'E'ffectively.
Module 2: Implementing Azure Platform Protection
Implementing Network Security in Azure
Memorize the distinct functions of NSGs, ASGs, and Azure Firewall. The exam often presents scenarios where you must choose the most appropriate tool for a specific network security requirement. Pay attention to keywords like 'subnet-level control' (NSG), 'application-centric rules' (ASG), and 'centralized FQDN filtering' (Azure Firewall).
Module 2: Implementing Azure Platform Protection
Implementing Network Security in Azure
Over-permissive NSG rules, allowing too much traffic.
Module 2: Implementing Azure Platform Protection
Implementing Network Security in Azure
Not understanding the order of NSG rule processing (lower priority number = evaluated first).
Module 2: Implementing Azure Platform Protection
Implementing Network Security in Azure
Confusing the capabilities of NSGs with Azure Firewall; they serve different purposes and levels of control.
Module 2: Implementing Azure Platform Protection
Azure Disk Encryption (ADE)
Encrypts VM disks using BitLocker (Windows) or DM-Crypt (Linux).
Module 2: Implementing Azure Platform Protection
Just-In-Time (JIT) VM Access
Limits exposure of management ports by opening them only when needed.
Module 2: Implementing Azure Platform Protection
Shared Responsibility Model
Defines security responsibilities between cloud provider and customer.
Module 2: Implementing Azure Platform Protection
Azure Bastion
Provides secure and seamless RDP/SSH connectivity to VMs over SSL.
Module 2: Implementing Azure Platform Protection
VM Hardening
Configuring VMs to reduce their attack surface and improve security.
Module 2: Implementing Azure Platform Protection
Securing Azure Virtual Machines and Host Infrastructure
To remember VM hardening steps: 'D.I.S.C.O.' - Disable unused services, Implement strong authentication, Secure network access, Close unused ports, Encrypt disks and data.
Module 2: Implementing Azure Platform Protection
Securing Azure Virtual Machines and Host Infrastructure
The exam frequently tests your understanding of the Shared Responsibility Model. Remember, Microsoft secures 'of' the cloud (physical, host OS), and you secure 'in' the cloud (guest OS, data, applications). Also, know the purpose of JIT VM access and Azure Disk Encryption.
Module 2: Implementing Azure Platform Protection
Securing Azure Virtual Machines and Host Infrastructure
Forgetting to encrypt data disks in addition to OS disks.
Module 2: Implementing Azure Platform Protection
Securing Azure Virtual Machines and Host Infrastructure
Leaving management ports (RDP/SSH) open to the internet without JIT access or Bastion.
Module 2: Implementing Azure Platform Protection
Securing Azure Virtual Machines and Host Infrastructure
Neglecting to apply security updates and patches to the guest operating system.
Module 2: Implementing Azure Platform Protection
Container Image
A lightweight, standalone, executable package of software.
Module 2: Implementing Azure Platform Protection
Container Registry
A centralized repository for storing and managing container images.
Module 2: Implementing Azure Platform Protection
Azure Kubernetes Service (AKS)
A managed Kubernetes service for deploying and managing containerized applications.
Module 2: Implementing Azure Platform Protection
Pod Security Policy (PSP)
Kubernetes API object to enforce security requirements on Pods.
Module 2: Implementing Azure Platform Protection
Azure Container Instances (ACI)
A service for running containers directly without managing servers.
Module 2: Implementing Azure Platform Protection
Network Policy
Kubernetes resource defining how groups of Pods communicate.
Module 2: Implementing Azure Platform Protection
Implementing Container Security in Azure
Images are like blueprints, Registries are like libraries, and Runtime is like the factory floor. Secure each step!
Module 2: Implementing Azure Platform Protection
Implementing Container Security in Azure
On the AZ-500 exam, be prepared to distinguish between securing the container image (e.g., ACR scanning, minimal images) and securing the runtime environment (e.g., AKS policies, network segmentation). Keywords like 'vulnerability scanning,' 'Azure Policy for Kubernetes,' and 'Azure Key Vault integration' are common.
Module 2: Implementing Azure Platform Protection
Implementing Container Security in Azure
Neglecting to scan container images for vulnerabilities before deployment.
Module 2: Implementing Azure Platform Protection
Implementing Container Security in Azure
Embedding secrets directly into container images instead of using Azure Key Vault.
Module 2: Implementing Azure Platform Protection
Implementing Container Security in Azure
Not implementing network segmentation or policies for container communication.
Module 2: Implementing Azure Platform Protection
Azure Key Vault
Cloud service for securely storing and accessing secrets, keys, and certificates.
Module 2: Implementing Azure Platform Protection
Secret
Sensitive data like passwords, API keys, or connection strings.
Module 2: Implementing Azure Platform Protection
Key
Cryptographic key used for encryption, decryption, signing.
Module 2: Implementing Azure Platform Protection
Certificate
X.509 certificate for authentication, encryption, digital signatures.
Module 2: Implementing Azure Platform Protection
Access Policy
Defines data plane permissions for identities to Key Vault objects.
Module 2: Implementing Azure Platform Protection
HSM
Hardware Security Module; provides FIPS 140-2 Level 2 validated protection for keys.
Module 2: Implementing Azure Platform Protection
Managing Secrets and Keys with Azure Key Vault
K-S-C: Keys Sign and Encrypt. Secrets are Strings. Certificates Confirm Identity.
Module 2: Implementing Azure Platform Protection
Managing Secrets and Keys with Azure Key Vault
The exam frequently tests the distinction between the management plane (Azure RBAC) and the data plane (Key Vault access policies) for access control. Also, know the difference between keys, secrets, and certificates.
Module 2: Implementing Azure Platform Protection
Managing Secrets and Keys with Azure Key Vault
Hardcoding secrets directly into application code or configuration files.
Module 2: Implementing Azure Platform Protection
Managing Secrets and Keys with Azure Key Vault
Granting 'All' permissions in Key Vault access policies instead of using least privilege.
Module 2: Implementing Azure Platform Protection
Managing Secrets and Keys with Azure Key Vault
Confusing Azure RBAC (management plane) with Key Vault access policies (data plane).
Module 2: Implementing Azure Platform Protection
Azure Monitor
Unified monitoring for Azure and hybrid environments.
Module 3: Managing Azure Security Operations
Log Analytics Workspace
Logical storage unit for Azure Monitor log data.
Module 3: Managing Azure Security Operations
Kusto Query Language (KQL)
Query language used to interact with log data.
Module 3: Managing Azure Security Operations
Data Connectors
Mechanism to ingest data into Log Analytics.
Module 3: Managing Azure Security Operations
Azure Monitor Alerts
Proactive notifications based on monitoring data.
Module 3: Managing Azure Security Operations
Action Groups
Collection of notification preferences and automated actions.
Module 3: Managing Azure Security Operations
Diagnostic Settings
Configures log export for Azure resources.
Module 3: Managing Azure Security Operations
Monitoring Security with Azure Monitor & Log Analytics
Log Analytics: L is for Logs, A is for Analyze, W is for Workspace. LAW is how you enforce security rules with your data!
Module 3: Managing Azure Security Operations
Monitoring Security with Azure Monitor & Log Analytics
Memorize that Kusto Query Language (KQL) is the primary language for querying data in Log Analytics. The exam often tests your understanding of basic KQL operators and how to filter for security events.
Module 3: Managing Azure Security Operations
Monitoring Security with Azure Monitor & Log Analytics
Not configuring data retention policies for Log Analytics workspaces, leading to excessive costs or insufficient historical data for investigations.
Module 3: Managing Azure Security Operations
Monitoring Security with Azure Monitor & Log Analytics
Failing to implement proper role-based access control (RBAC) on Log Analytics workspaces, potentially exposing sensitive security data.
Module 3: Managing Azure Security Operations
Monitoring Security with Azure Monitor & Log Analytics
Creating too many generic alerts that generate 'alert fatigue' for security teams, instead of focusing on high-fidelity, actionable alerts.
Module 3: Managing Azure Security Operations
CSPM
Cloud Security Posture Management; identifies misconfigurations.
Module 3: Managing Azure Security Operations
CWP
Cloud Workload Protection; advanced threat detection for workloads.
Module 3: Managing Azure Security Operations
Secure Score
Quantified measure of an organization's security posture.
Module 3: Managing Azure Security Operations
Security Recommendations
Actionable steps to improve security posture.
Module 3: Managing Azure Security Operations
Just-in-Time VM Access
Limits network access to VMs to specific times/sources.
Module 3: Managing Azure Security Operations
Adaptive Application Controls
Whitelists allowed applications for VMs.
Module 3: Managing Azure Security Operations
Utilizing Microsoft Defender for Cloud
Think 'DEFEND your CLOUD with a SCORE'. Defender for Cloud gives you a Secure Score to defend your cloud resources.
Module 3: Managing Azure Security Operations
Utilizing Microsoft Defender for Cloud
Memorize that Microsoft Defender for Cloud provides both CSPM and CWP capabilities. The exam often asks about its role in improving 'security posture' (CSPM) and providing 'threat protection' (CWP) for various Azure resources.
Module 3: Managing Azure Security Operations
Utilizing Microsoft Defender for Cloud
Confusing Defender for Cloud with Microsoft 365 Defender (which focuses on endpoint, identity, email, and app security).
Module 3: Managing Azure Security Operations
Utilizing Microsoft Defender for Cloud
Underestimating the importance of the Secure Score; it's a key metric for security posture.
Module 3: Managing Azure Security Operations
Utilizing Microsoft Defender for Cloud
Forgetting that the advanced threat protection features (CWP) are part of the paid Defender plans, not the free tier.
Module 3: Managing Azure Security Operations
Security Alert
Notification of potential security threats or suspicious activity.
Module 3: Managing Azure Security Operations
Incident Response
Structured process for handling and resolving security incidents.
Module 3: Managing Azure Security Operations
Playbook
Automated workflow for responding to security alerts or incidents.
Module 3: Managing Azure Security Operations
Azure Sentinel
Cloud-native SIEM and SOAR solution for security management.
Module 3: Managing Azure Security Operations
Triage
Process of prioritizing alerts based on severity and impact.
Module 3: Managing Azure Security Operations
Containment
Actions taken to limit the scope and impact of a security incident.
Module 3: Managing Azure Security Operations
Remediation
Eliminating the root cause and restoring systems to a secure state.
Module 3: Managing Azure Security Operations
Managing and Responding to Security Alerts
To remember the alert lifecycle: D-T-I-R-R-I (Detect, Triage, Investigate, Respond, Recover, Improve). Think 'DTI-RRI', like a security report.
Module 3: Managing Azure Security Operations
Managing and Responding to Security Alerts
The exam often tests your understanding of the alert lifecycle and the capabilities of Azure Sentinel playbooks for automation. Be prepared to differentiate between investigation and response phases.
Module 3: Managing Azure Security Operations
Managing and Responding to Security Alerts
Ignoring low-severity alerts, as they can sometimes be precursors to larger attacks.
Module 3: Managing Azure Security Operations
Managing and Responding to Security Alerts
Failing to document lessons learned from incidents, leading to repeated issues.
Module 3: Managing Azure Security Operations
Managing and Responding to Security Alerts
Not testing automated response playbooks, which can cause unexpected outcomes during a real incident.
Module 3: Managing Azure Security Operations
Azure Policy
Service to enforce organizational standards and assess compliance.
Module 3: Managing Azure Security Operations
Policy Definition
JSON document specifying conditions and effects of a policy.
Module 3: Managing Azure Security Operations
Initiative Definition
A collection of policy definitions grouped for a larger goal.
Module 3: Managing Azure Security Operations
Policy Assignment
Applying a policy or initiative to a specific scope.
Module 3: Managing Azure Security Operations
Azure Blueprints
Service to define repeatable sets of Azure resources for governance.
Module 3: Managing Azure Security Operations
Artifacts
Components within a blueprint like policies, roles, and ARM templates.
Module 3: Managing Azure Security Operations
Resource Locking
Feature of Blueprints to prevent modification/deletion of resources.
Module 3: Managing Azure Security Operations
Compliance
Adherence to rules, standards, or regulations.
Module 3: Managing Azure Security Operations
Configuring Azure Security Policies and Blueprints
Policy is for Policing rules. Blueprints are for Building consistent environments.
Module 3: Managing Azure Security Operations
Configuring Azure Security Policies and Blueprints
The exam often tests the distinction between Azure Policy and Azure Blueprints. Remember: Policy enforces rules on resources, while Blueprints define and deploy a consistent set of resources and their governance.
Module 3: Managing Azure Security Operations
Configuring Azure Security Policies and Blueprints
Confusing Azure Policy with Azure Blueprints: Policy enforces rules; Blueprints deploy and govern entire environments.
Module 3: Managing Azure Security Operations
Configuring Azure Security Policies and Blueprints
Not understanding policy effects: 'Audit' identifies non-compliance, 'Deny' prevents it, 'Deploy if not exists' remediates.
Module 3: Managing Azure Security Operations
Configuring Azure Security Policies and Blueprints
Ignoring the scope of assignments: Policies and blueprints can be assigned at management group, subscription, or resource group level.
Module 3: Managing Azure Security Operations
Azure Logic Apps
Cloud service for automating workflows and tasks.
Module 3: Managing Azure Security Operations
Azure Functions
Serverless compute service for event-driven code.
Module 3: Managing Azure Security Operations
Azure Automation
Cloud service for process automation and configuration.
Module 3: Managing Azure Security Operations
SOAR
Security Orchestration, Automation, and Response.
Module 3: Managing Azure Security Operations
SIEM
Security Information and Event Management.
Module 3: Managing Azure Security Operations
Automating Security Operations and Remediation
Think 'LAF' for Logic Apps, Automation, Functions – the core trio for security automation in Azure. LAF makes security a laugh!
Module 3: Managing Azure Security Operations
Automating Security Operations and Remediation
The exam often tests your ability to choose the right Azure automation service for a given scenario. Remember Logic Apps for complex workflows, Functions for custom code snippets, and Automation for scheduled tasks or configuration management.
Module 3: Managing Azure Security Operations
Automating Security Operations and Remediation
Over-automating without proper testing, leading to unintended service disruptions.
Module 3: Managing Azure Security Operations
Automating Security Operations and Remediation
Not integrating automation with existing security tools and processes, creating silos.
Module 3: Managing Azure Security Operations
Automating Security Operations and Remediation
Failing to monitor automated actions, missing when they fail or act incorrectly.
Module 3: Managing Azure Security Operations
Azure Storage Account
A scalable cloud storage service for blobs, files, queues, and tables.
Module 4: Securing Data and Applications
Shared Access Signature (SAS)
A URI granting time-limited, delegated access to storage resources.
Module 4: Securing Data and Applications
Storage Service Encryption (SSE)
Default encryption at rest for Azure Storage using Microsoft-managed keys.
Module 4: Securing Data and Applications
Customer-Managed Keys (CMK)
Encryption keys managed by the customer in Azure Key Vault.
Module 4: Securing Data and Applications
Soft Delete
A feature that retains deleted data for a specified period for recovery.
Module 4: Securing Data and Applications
Azure Storage Firewall
Network rules controlling access to a storage account based on IP or VNet.
Module 4: Securing Data and Applications
Configuring Security for Azure Storage Accounts
To secure your Storage, remember 'NICE Data': **N**etwork Access, **I**dentity, **C**ryptography, **E**xternal Access (SAS), **D**ata Protection, **A**uditing.
Module 4: Securing Data and Applications
Configuring Security for Azure Storage Accounts
For the AZ-500 exam, memorize the different types of SAS (user delegation, service) and when to use each. Understand the default encryption (SSE) vs. customer-managed keys (CMK) and how to implement CMK with Key Vault. Know the network access options: public endpoint, service endpoint, and private endpoint.
Module 4: Securing Data and Applications
Configuring Security for Azure Storage Accounts
Leaving storage accounts publicly accessible without proper network restrictions.
Module 4: Securing Data and Applications
Configuring Security for Azure Storage Accounts
Using storage account access keys directly in applications instead of SAS or Azure AD.
Module 4: Securing Data and Applications
Configuring Security for Azure Storage Accounts
Not enabling soft delete or versioning, leading to permanent data loss from accidental deletions.
Module 4: Securing Data and Applications
Transparent Data Encryption (TDE)
Encrypts an entire database, backups, and transaction log files at rest.
Module 4: Securing Data and Applications
Azure Active Directory (Azure AD) authentication
Centralized identity management for database access, supporting MFA.
Module 4: Securing Data and Applications
Private Link
Provides private connectivity to Azure PaaS services over a VNet.
Module 4: Securing Data and Applications
Virtual Network (VNet) service endpoint
Extends your VNet's identity to Azure service resources.
Module 4: Securing Data and Applications
TLS (Transport Layer Security)
Encrypts data in transit between client applications and database servers.
Module 4: Securing Data and Applications
Azure Defender for SQL
Advanced threat protection for Azure SQL databases and SQL VMs.
Module 4: Securing Data and Applications
Auditing
Recording database events and changes for compliance and security analysis.
Module 4: Securing Data and Applications
Implementing Security for Azure Databases
Think of 'TDE' as 'Totally Data Encrypted' – it covers your entire database at rest!
Module 4: Securing Data and Applications
Implementing Security for Azure Databases
The exam often tests the differences between network security options like Private Link, VNet service endpoints, and firewall rules. Memorize that Private Link offers the most secure and private access, keeping traffic entirely within the Microsoft backbone network.
Module 4: Securing Data and Applications
Implementing Security for Azure Databases
Relying solely on IP-based firewall rules without considering Private Link or VNet service endpoints for enhanced security.
Module 4: Securing Data and Applications
Implementing Security for Azure Databases
Using SQL authentication only, missing out on the benefits of centralized identity management and MFA with Azure AD.
Module 4: Securing Data and Applications
Implementing Security for Azure Databases
Granting excessive permissions (over-privileging) to users or applications, which violates the principle of least privilege.
Module 4: Securing Data and Applications
Synapse Workspace
A secure boundary for all analytics resources in Azure Synapse Analytics.
Module 4: Securing Data and Applications
Synapse RBAC
Role-Based Access Control specific to Synapse workspace resources and operations.
Module 4: Securing Data and Applications
Managed VNet
A virtual network managed by Synapse for private network isolation of workspace resources.
Module 4: Securing Data and Applications
Dedicated SQL Pool
A data warehousing component in Synapse Analytics, formerly SQL Data Warehouse.
Module 4: Securing Data and Applications
Serverless SQL Pool
A query service in Synapse for analyzing data in ADLS Gen2 without provisioning resources.
Module 4: Securing Data and Applications
Securing Data in Azure Synapse Analytics
Synapse Security: A-W-A-N-D-T. Azure AD, Workspace, Access Control, Network, Data Encryption, Threat Protection.
Module 4: Securing Data and Applications
Securing Data in Azure Synapse Analytics
The AZ-500 exam frequently tests your understanding of the different layers of security in Synapse, especially the distinction between Azure RBAC and Synapse RBAC roles, and the application of network isolation via Private Endpoints for data exfiltration prevention.
Module 4: Securing Data and Applications
Securing Data in Azure Synapse Analytics
Confusing Azure RBAC roles with Synapse RBAC roles; they have different scopes.
Module 4: Securing Data and Applications
Securing Data in Azure Synapse Analytics
Forgetting to implement private endpoints for data ingestion/egress, leaving data vulnerable.
Module 4: Securing Data and Applications
Securing Data in Azure Synapse Analytics
Not understanding that CMK is an option for enhanced data at rest encryption, not just Microsoft-managed keys.
Module 4: Securing Data and Applications
App Service Environment (ASE)
Dedicated, fully isolated environment for App Service apps.
Module 4: Securing Data and Applications
VNet Integration
Connects App Service to a Virtual Network for resource access.
Module 4: Securing Data and Applications
Easy Auth
Built-in authentication/authorization for App Service.
Module 4: Securing Data and Applications
Access Restrictions
Rules to control inbound network traffic to an App Service.
Module 4: Securing Data and Applications
Configuring Security for Azure App Service
App Service Security: 'NICE' apps are Secure. N-Network Isolation, I-Identity/Auth, C-Code/Data Protection, E-Encryption.
Module 4: Securing Data and Applications
Configuring Security for Azure App Service
The exam frequently tests on how to secure secrets and control network access for App Service. Keywords to watch for are 'Key Vault', 'Managed Identities', 'VNet Integration', 'App Service Environment', and 'Access Restrictions'. Remember that ASE provides full network isolation.
Module 4: Securing Data and Applications
Configuring Security for Azure App Service
Hardcoding secrets (like connection strings or API keys) directly into application code or configuration files instead of using Azure Key Vault.
Module 4: Securing Data and Applications
Configuring Security for Azure App Service
Not implementing network isolation (e.g., VNet Integration, Private Endpoints) for sensitive applications, leaving them exposed to the public internet without proper filtering.
Module 4: Securing Data and Applications
Configuring Security for Azure App Service
Relying solely on network security without also implementing strong authentication and authorization within the application itself.
Module 4: Securing Data and Applications
AKS Control Plane
Managed by Microsoft; orchestrates Kubernetes.
Module 4: Securing Data and Applications
Azure Container Registry (ACR)
Managed service for storing and managing Docker container images.
Module 4: Securing Data and Applications
Kubernetes RBAC
Role-Based Access Control for authorizing users/apps to AKS.
Module 4: Securing Data and Applications
Managed Identities
Azure AD identities for Azure resources to authenticate securely.
Module 4: Securing Data and Applications
Kubernetes Network Policy
Specifies how groups of pods are allowed to communicate.
Module 4: Securing Data and Applications
Private AKS Cluster
API server endpoint is private, not exposed to public internet.
Module 4: Securing Data and Applications
Azure CNI
Container Network Interface for advanced AKS networking.
Module 4: Securing Data and Applications
Implementing Security for Azure Kubernetes Service (AKS)
AKS: 'Always Keep Secure' – A for Azure AD, K for Key Vault, S for Security Center.
Module 4: Securing Data and Applications
Implementing Security for Azure Kubernetes Service (AKS)
The exam frequently tests the shared responsibility model for AKS. Remember Microsoft manages the control plane, while you are responsible for nodes, images, and applications. Also, know the benefits of private clusters and Managed Identities.
Module 4: Securing Data and Applications
Implementing Security for Azure Kubernetes Service (AKS)
Forgetting to scan container images for vulnerabilities before deployment.
Module 4: Securing Data and Applications
Implementing Security for Azure Kubernetes Service (AKS)
Exposing the AKS API server publicly when a private cluster is more appropriate.
Module 4: Securing Data and Applications
Implementing Security for Azure Kubernetes Service (AKS)
Hardcoding secrets directly into container images or application code instead of using Azure Key Vault.
Module 4: Securing Data and Applications