← Back to Portal

Attack Plan

Exam strategy, domain weights, 7-day sprint protocol, decision trees, and the 8 traps that catch candidates.

Domain weights Decision trees 7-day study sprint 8 exam traps Rapid recall

Domain Weights

D1 · Identity & Access Management
25–30%
D2 · Secure Networking
20–25%
D3 · Compute, Storage & Databases
20–25%
D4 · Security Operations
25–30%

D1 and D4 are the highest-weight domains — together they represent ~55% of the exam. Master identity fundamentals (PIM, CA, RBAC, Managed Identity) and operational tooling (Defender for Cloud, Sentinel, Policy) first.

7-Day Study Sprint Protocol

1
D1 — Identity Foundations (PIM + CA + RBAC)
  • Read D1 crash course section in full
  • Build a CA policy logic table: Signal → Condition → Grant → What triggers it?
  • Practice: What happens when user is in both Include AND Exclude? (Answer: excluded)
  • Complete cheatsheet Section 1 — confirm you can recall all licence tiers cold
2
D2 — Secure Networking (NSG + Firewall + Private Endpoints)
  • Read D2 crash course section
  • Draw the NSG evaluation flow: inbound vs outbound, subnet vs NIC
  • Master the Azure Firewall rule order table
  • Compare Service Endpoint vs Private Endpoint — know every difference cold
3
D3 — Compute / Storage / Databases
  • Read D3 crash course section
  • Encryption matrix: PMK vs CMK vs ADE vs Enc@Host — when does each apply?
  • Key Vault: Access Policy vs RBAC mode — what breaks when you switch?
  • SQL security: TDE vs DDM vs Always Encrypted — who can bypass each?
4
D4 — Security Operations (Defender + Sentinel + Policy)
  • Read D4 crash course section
  • Secure Score formula: all-or-nothing per control — memorise this
  • Sentinel analytics rule types: which are modifiable? Which cannot be changed?
  • Policy effects: Deny vs Audit vs DeployIfNotExists — what each does to existing resources
5
Mock Exam — Set A (50 questions, timed)
  • Complete Set A under timed conditions (150 minutes)
  • Review every wrong answer — read the full explanation
  • Identify weakest domain from results breakdown
  • Re-read the crash course section for your weakest domain
6
Exam Prep + Trap Catalogue + Mock Set B
  • Complete Exam Prep questions (trap-focused)
  • Read through the 8 exam trap cards on this page — recite each answer aloud
  • Complete Mock Set B — review all explanations
  • Cheatsheet review: Sections 5 and 6 (Golden Rules + Critical Numbers)
7
Final Sprint — Mock Set C + Focused Mode
  • Complete Mock Set C under timed conditions
  • Run Focused Mode on any remaining wrong questions
  • Final read: 20 Golden Rules (cheatsheet Section 5)
  • Rest — exam day: trust your preparation

Decision Trees — Identity & Access

Q: Which CA condition — user is in BOTH Include AND Exclude. Does the policy apply? → NO — Exclude always wins. Policy does not apply. Q: Two CA policies match a sign-in: Policy A (MFA required) + Policy B (Block). What happens? → BLOCKED. Both apply. Block is more restrictive. User cannot sign in. Q: User activates PIM role but colleague can't see it on the user's role list. Why? → Check PIM — Activation may have failed (MFA not completed / pending approval). PIM active roles DO appear on the roles page when active. Q: System-assigned MI is used in a KV access policy. The resource is recreated. What breaks? → KV access breaks. New resource = new Principal ID. Re-add the new MI to the access policy. Q: RBAC vs Access Policy mode for Key Vault. You switch to RBAC mode. What breaks? → ALL access policies break immediately. RBAC mode ignores access policies. Must create RBAC role assignments first.

Decision Trees — Networking

Q: Subnet NSG has Deny all inbound (priority 100). NIC NSG has Allow RDP (priority 100). RDP works? → NO. Inbound: subnet NSG evaluated first. Deny at 100 matches → processing stops. NIC NSG not reached. Q: Azure Firewall network rule allows port 443. App rule allows *.microsoft.com HTTPS. User requests https://login.microsoftonline.com. Which rule fires? → Application rule. HTTP/HTTPS = Application rules evaluated first. Q: Private DNS Zone linked to VNet-A. VM in peered VNet-B queries private endpoint FQDN. Private IP resolved? → NO. DNS zone links not transitive through peering. Link the zone to VNet-B explicitly. Q: Need on-premises access to Azure Storage via private IP. Use Service Endpoint or Private Endpoint? → Private Endpoint. Service Endpoints do not work from on-premises. Private Endpoints accessible via VPN/ExpressRoute.

Decision Trees — Security Operations

Q: Fix 4 of 5 recommendations in a Secure Score control. Score improves? → NO. All-or-nothing. 0 points until ALL 5 pass. Q: Azure Policy DeployIfNotExists assigned. 100 VMs already exist and are non-compliant. Auto-remediated? → NO. DINE auto-remediates NEW resources only. Create a Remediation Task for existing VMs. Q: Sentinel Fusion rule is generating too many false positives. Tune the rule? → CANNOT tune. Fusion rules are managed by Microsoft and cannot be modified. Investigate via incident, not by editing the rule. Q: IDPS on Azure Firewall Premium is in Alert mode. Malware C2 traffic detected. Blocked? → NOT blocked. Alert mode = log + alert only. Switch to "Alert and Deny" to block.

8 Exam Traps — Know These Cold

1 The CA Exclude Trap

The bait: A policy includes a group AND excludes the same user individually. Does the user get MFA?

Answer: NO — Exclusions always override Inclusions in the SAME policy.

Exam twist: The user is in a GROUP that is excluded. Adding them to an included group does nothing. Excluded.

2 The System-Assigned MI Lifecycle Trap

The bait: Function App recreated — same config — can't access Key Vault. Why?

Answer: New resource = NEW managed identity with a NEW Principal ID. The old KV access policy points to the deleted principal. Re-add the new MI.

3 The Key Vault Access Mode Switch Trap

The bait: You switch KV from Access Policy to RBAC mode. Everything breaks. Why?

Answer: The switch immediately ignores ALL access policies. RBAC role assignments must be created BEFORE switching, or services lose access instantly. Switching is NOT reversible without planning.

4 The RBAC Scope Trap

The bait: User has Reader at subscription. Also has Key Vault Secrets User on a KV. Can they read secret values?

Answer: YES — RBAC is additive. Both roles apply. Reader provides metadata access; KV Secrets User provides data plane access. The union applies.

Exam twist: A Deny assignment (from Policy) WOULD block it. But additive role overlaps do not conflict.

5 The NSG Inbound Order Trap

The bait: Subnet NSG has Deny All (priority 100). NIC NSG has Allow RDP (priority 100). Does RDP work?

Answer: NO — Inbound traffic hits the subnet NSG first. Deny matches. Processing stops. NIC NSG is never evaluated for inbound traffic.

6 The Secure Score Partial Credit Trap

The bait: You fix 4 of 5 recommendations in a control. Secure Score goes up?

Answer: NO — Points for a control are ALL-OR-NOTHING. Fix all 5 to earn the control's points. No partial credit.

Exam twist: "The Secure Score will improve proportionally" is always the wrong answer.

7 The DeployIfNotExists Existing Resources Trap

The bait: Policy with DeployIfNotExists assigned. 200 non-compliant VMs exist. After assignment, how do you remediate?

Answer: Create a Remediation Task. DINE auto-remediates NEW resources only. Existing resources need an explicit Remediation Task created from the policy assignment.

8 The DDM db_owner Bypass Trap

The bait: Dynamic Data Masking on Salary column. DBA queries it. What do they see?

Answer: Unmasked actual values. db_owner, sysadmin, and UNMASK-granted users always see plaintext. DDM only masks data for non-privileged users.

Exam twist: Only Always Encrypted protects data from DBAs. TDE and DDM do not.

Rapid Recall Cards — 60-Second Review

Identity — PIM
P2 licence
Eligible ≠ active. Max duration = per activation. No daily limit on activations.
Identity — CA
Exclude > Include
All matching policies apply. Block beats MFA. Report-only = no enforcement.
Identity — Managed Identity
System: tied to lifecycle
User-Assigned: survives deletion, shareable. Recreated resource = new MI Principal ID.
Identity — SSPR
Privileged roles: 2 methods required
Regardless of org SSPR policy. On-premises writeback: requires P1 + Entra Connect.
Network — NSG
Lowest priority first
Inbound: subnet NSG before NIC NSG. Default deny-all = 65500 (undeleteable).
Network — Azure Firewall
DNAT → Network → Application
Exception: HTTP/HTTPS → Application rules first. IDPS requires Premium SKU.
Network — Private Endpoint
Private IP, disables public, on-prem works
Needs Private DNS Zone linked to each VNet. Not transitive through peering.
Compute — Disk Encryption
ADE ≠ temp disk
Encryption at Host = includes temp disk. CMK: disabling key = INACCESSIBLE storage.
Storage — SAS
User Delegation SAS = most secure
SAP deletion = instant revocation of all linked SAS. Account/Service SAS: revoke by rotating key.
Database — SQL
DDM bypassed by db_owner
Always Encrypted = only protection DBAs cannot bypass. TDE is transparent to all users.
Operations — Secure Score
All-or-nothing per control
0 points if any recommendation in a control is failing. No partial credit.
Operations — Policy
DINE: existing VMs need Remediation Task
Deny = blocks new. DINE = deploys companion. Modify = changes existing. Audit = logs only.