AZ-500 Quick Reference Cheat Sheet | NetForge Cloud Learning

Section 1 — Identity & Access Management

Entra ID Licence Tiers

Feature	Free	P1	P2
Basic MFA	✓	✓	✓
Conditional Access	✗	✓	✓
Dynamic Groups	✗	✓	✓
SSPR	✗	✓	✓
PIM	✗	✗	P2 only
Identity Protection	✗	✗	P2 only
Access Reviews	✗	✗	P2 only
Entitlement Management	✗	✗	P2 only

Key Azure RBAC Roles

Role	Can Do	Cannot Do
Owner	Everything + assign roles	—
Contributor	Create/manage all resources	Assign roles, manage billing
Reader	View all resources	Create/modify/delete
User Access Admin	Manage RBAC	Manage resources
Security Admin	Manage Defender policies	Assign non-security roles
Security Reader	View security state	Change anything
KV Secrets User	Read secret VALUES	List/Set/Delete
KV Secrets Officer	Manage secrets	Manage RBAC
KV Reader	Read metadata only	Read secret values
Storage Blob Data Contributor	Read/write/delete blobs	Manage storage account (keys, settings)
AcrPush	Pull + Push to ACR	Manage registry

RBAC Scope — Critical Facts Valid scopes (top to bottom): Management Group → Subscription → Resource Group → Resource
Subnet is NOT a valid RBAC scope.
RBAC is ADDITIVE — no conflicts except Deny assignments.
Deny assignments ALWAYS override role assignments.

PIM Reference

Setting	Behaviour
Eligible	Can activate — no access until activated
Active	Currently has access
Permanent	Always active, no expiry
Time-bound	Active until a specific date/time
Activation requirements	Configurable: MFA, justification text, approval
Activation duration	Max per session (not per day — can re-activate)
Approvers	Designated individuals/groups in role settings — NOT automatic

Conditional Access — Key Rules

Component	Key Behaviour
Exclusion vs Inclusion	Exclude ALWAYS wins over Include — within the same policy
Multiple policies	ALL matching policies apply — most restrictive grant wins
Report-only mode	Evaluates but takes NO enforcement action
Trusted locations	Bypass MFA only if location is the policy CONDITION (not the grant)
Service principals	Cannot complete interactive MFA — exclude from user MFA policies

Identity Protection Risk Detections

Detection	Risk Type	Level
Leaked credentials	User risk	High
Atypical/impossible travel	Sign-in risk	Medium
Anonymous IP (Tor)	Sign-in risk	Medium/High
Password spray	User risk	High
Malware-linked IP	Sign-in risk	High
Unfamiliar sign-in properties	Sign-in risk	Medium

Managed Identity Comparison

Feature	System-Assigned	User-Assigned
Lifecycle	Tied to resource	Independent
Sharing	1:1 (one resource)	1:many (multiple resources)
Survives resource recreation	✗ New principal ID	✓
Use when	Single resource, simple scenario	Multiple resources need same identity

Section 2 — Secure Networking

NSG Rules — Critical Facts

Default Rule	Priority	Direction	Action
AllowVnetInBound	65000	Inbound	Allow
AllowAzureLoadBalancerInBound	65001	Inbound	Allow
DenyAllInBound	65500	Inbound	Deny all
AllowVnetOutBound	65000	Outbound	Allow
AllowInternetOutBound	65001	Outbound	Allow
DenyAllOutBound	65500	Outbound	Deny all

NSG Evaluation Order Lowest priority number = evaluated first. First match wins. Stop processing. Inbound: Subnet NSG evaluated BEFORE NIC NSG.

Azure Firewall SKU Comparison

Feature	Basic	Standard	Premium
L3/L4 + FQDN filtering	✓	✓	✓
Threat Intelligence Alert+Deny	Alert only	✓	✓
TLS Inspection	✗	✗	Premium only
IDPS	✗	✗	Premium only
URL Filtering / Web Categories	✗	✗	Premium only

Azure Firewall Rule Processing Order DNAT → Network → Application. EXCEPTION: for HTTP/HTTPS, Application rules are evaluated BEFORE Network rules.

Service Endpoint vs Private Endpoint

Attribute	Service Endpoint	Private Endpoint
Private IP assigned	✗	✓
Public endpoint can be disabled	✗	✓ (configurable)
On-premises access (via VPN/ER)	✗	✓
DNS change needed	✗	✓ Private DNS Zone
Transitive through VNet peering	✗	✓ (with DNS link)
Cost	Free	Per-hour + processing

Private DNS Zone — Critical Trap Private DNS Zones must be LINKED to each VNet individually. They are NOT transitive through VNet peering. Each VNet that needs private DNS resolution must have an explicit link to the zone.

Why the Private DNS Zone Name Must Be Exact

When a Private Endpoint is attached to a service, Azure resolves the public FQDN via a two-hop CNAME chain to land on the private IP:

myregistry.azurecr.io → CNAME → myregistry.privatelink.azurecr.io → A record → 10.0.0.5 (private IP in your VNet) If the Private DNS Zone is named incorrectly (e.g. privatelink.acr.microsoft.com), the CNAME lookup fails — nothing resolves to the private IP.

Pattern Rule — memorise this Take the public URL suffix and insert privatelink. immediately before it.
*.azurecr.io → zone name is privatelink.azurecr.io (not privatelink.acr.microsoft.com)
Azure keeps the core domain string identical — it never renames azurecr to acr.

Common Private DNS Zone Names

Service	Public URL Pattern	Correct Private DNS Zone Name
Container Registry (ACR)	`*.azurecr.io`	privatelink.azurecr.io
Blob Storage	`*.blob.core.windows.net`	privatelink.blob.core.windows.net
Key Vault	`*.vaultcore.azure.net`	privatelink.vaultcore.azure.net
Azure SQL Database	`*.database.windows.net`	privatelink.database.windows.net
App Service / Web Apps	`*.azurewebsites.net`	privatelink.azurewebsites.net

DDoS Protection Tiers

Tier	Cost	Key Features
DDoS Basic	Free	Always-on, generic protection for all public IPs
DDoS Network Protection	Per VNet	Adaptive tuning, attack analytics, cost protection, DRR team
DDoS IP Protection	Per public IP	Per-IP protection without adaptive tuning

Azure Bastion SKUs

Feature	Basic	Standard
Browser-based RDP/SSH	✓	✓
Native RDP/SSH client	✗	Standard only
Connect to peered VNet VMs	✗	Standard only
File upload/download	✗	✓

Section 3 — Compute, Storage & Databases

Key Vault Access Models (MUTUALLY EXCLUSIVE)

Access Policy vs RBAC — Cannot Both Be Active Access Policy mode: Permissions granted per principal (Get/List/Set/Delete). RBAC data plane roles are IGNORED.
Azure RBAC mode: Use role assignments (Secrets User, Officer, etc.). Access Policies are IGNORED.
Switching to RBAC mode does NOT migrate access policies — they break immediately.

Disk Encryption Comparison

Method	Layer	Key Managed By	OS Disk	Temp Disk
SSE Platform-Managed	Storage	Microsoft	✓	✗
SSE Customer-Managed (CMK)	Storage	Customer (KV)	✓	✗
ADE (BitLocker/dm-crypt)	OS (in VM)	Customer (KV)	✓	✗ (use Enc@Host)
Encryption at Host	Hypervisor	Customer/MS	✓	✓

Azure SQL Security Features

Feature	What It Does	Key Property
TDE	Encrypts database files at rest	Transparent — DBAs see plaintext
Dynamic Data Masking	Masks column values in query results	db_owner bypasses masking
Always Encrypted	Client-side column encryption	DBAs see encrypted data — cannot bypass
Row-Level Security	Filters rows based on user context	Security predicate function
Entra ID-Only Auth	Disables SQL logins entirely	Set Entra ID admin BEFORE enabling

Storage SAS Token Types

Type	Signed By	Revocation Method
Account SAS	Storage account key	Rotate the signing key
Service SAS	Storage account key	Rotate key OR revoke linked SAP
User Delegation SAS	Entra ID (delegation key)	Revoke delegation key / remove permissions
Stored Access Policy (SAP)	—	Delete/modify SAP → all linked SAS instantly revoked

Container Security Reference

Feature	Purpose
ACR content trust	Image signing with Notary — unsigned images rejected
Defender for Containers	Runtime threat detection + image vulnerability scanning in ACR
Workload Identity (OIDC)	Pod identity via federated credential — NO secrets in pods
Secrets Store CSI Driver	Mount KV secrets as pod volumes using Workload Identity
Private cluster	AKS API server with no public endpoint

Section 4 — Security Operations

Microsoft Defender for Cloud Plans

Plan	Protects	Key Detections
Defender for Servers P1	VMs	MDE integration, adaptive app controls
Defender for Servers P2	VMs	P1 + JIT access, FIM, vulnerability assessment
Defender for SQL	Azure SQL, MI, on-VM	SQL injection, brute force, anomalous queries
Defender for Storage	Storage accounts	Malware upload, unusual downloads, suspicious access
Defender for Containers	AKS, ACR, CI/CD	Image vulnerabilities, runtime threats
Defender for Key Vault	Key Vault	Unusual access, high-volume reads
Defender CSPM (enhanced)	Entire estate	Attack path analysis, cloud security graph

Secure Score Formula — All-or-Nothing Score = (Points awarded / Max possible points) × 100
Points for a control = 0 if ANY recommendation is failing. Points = max if ALL are passing.
No partial credit per recommendation.

Sentinel Analytics Rule Types

Type	KQL?	Frequency	Modifiable?
Scheduled	✓	Every X minutes (configurable)	✓
NRT (Near Real-Time)	✓	~1 minute	✓
Microsoft Security	✗	On alert from MS product	Limited
Fusion	✗	Continuous (ML-based)	Cannot modify
ML Behaviour Analytics	✗	ML-based	Limited

Sentinel Log Tables Reference

Table	Source	Use For
SignInLogs	Entra ID	User sign-ins, risk detections, location
AuditLogs	Entra ID	Directory changes, Entra ID role management
AzureActivity	Azure ARM	Azure RBAC assignments, resource operations
SecurityEvent	Windows VMs	4624 (logon), 4625 (fail), 4720 (user created)
AzureDiagnostics	Multiple PaaS	Key Vault, SQL, NSG Flow Logs, Firewall
StorageBlobLogs	Storage	Blob read/write/delete operations

Azure Policy Effects — Processing Order

Disabled → Append → Audit → AuditIfNotExists → Deny → DeployIfNotExists → Modify Deny: blocks deployment DeployIfNotExists: deploys companion resource (needs managed identity with RBAC) EXISTING non-compliant resources → require a Remediation Task to be created

Critical KQL Patterns

-- Failed Entra ID sign-ins (last 24h)
SignInLogs
| where TimeGenerated > ago(24h) and ResultType != 0
| summarize FailCount = count() by UserPrincipalName, IPAddress

-- Azure RBAC role assignments created today
AzureActivity
| where OperationNameValue =~ "MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE"
| where ActivityStatusValue == "Success"
| project TimeGenerated, Caller, Properties

-- Entra ID privileged role changes
AuditLogs
| where Category == "RoleManagement"
| where OperationName contains "Add member to role"
| project TimeGenerated, InitiatedBy, TargetResources, OperationName

-- Key Vault secret reads
AzureDiagnostics
| where ResourceType == "VAULTS"
| where OperationName == "SecretGet"
| project TimeGenerated, Resource, CallerIPAddress, identity_claim_upn_s

-- Azure management operations by specific user (last 30 days)
AzureActivity
| where Caller == "user@contoso.com"
| where TimeGenerated > ago(30d)
| project TimeGenerated, OperationNameValue, ResourceGroup, ActivityStatusValue

Section 5 — 20 Golden Rules to Recall Cold

Identity Rules (1–5)

1

PIM eligible ≠ active. Must activate to gain access. Eligible shows in PIM — not in standard role list.

2

CA Exclude > CA Include. If a user is in both, they are excluded. Always.

3

System MI + resource recreation = new principal ID. Access policies pointing to old MI break immediately.

4

RBAC is additive. No conflicts. Only Deny assignments can block a permitted action.

5

KV access models are mutually exclusive. Access Policy OR RBAC. Switching to RBAC mode silently ignores all access policies.

Network Rules (6–10)

6

NSG = lowest priority first. First match stops processing. Inbound: subnet NSG before NIC NSG.

7

Azure Firewall HTTP/HTTPS = Application rules first. Network rules are evaluated after for other protocols.

8

Private DNS Zone must be linked to EACH VNet. Not transitive through peering.

9

Service Endpoint = subnet-scoped. Does not eliminate public endpoint. On-premises cannot use it.

10

Private Endpoint = private IP + can disable public endpoint. Accessible from on-premises via VPN/ER.

Compute/Storage/DB Rules (11–15)

11

DDM bypassed by db_owner. Always Encrypted is the real data protection — DBAs cannot bypass it.

12

SAS revocation = rotate signing key (Account/Service SAS). OR delete the Stored Access Policy for instant revocation without key rotation.

13

ADE = OS-level BitLocker. Keys in Key Vault. Does NOT encrypt temp disk — use Encryption at Host for that.

14

CMK = customer owns the key. Disabling/deleting the key = storage account INACCESSIBLE. No fallback to PMK.

15

User Delegation SAS = Entra ID signed. More secure. Revocable via identity (no key rotation needed).

Operations Rules (16–20)

16

Secure Score: all-or-nothing per control. All recommendations in a control must pass to earn points. No partial credit.

17

Defender for Cloud = per-service plans. Sentinel = cross-source SIEM/SOAR correlation. Different tools.

18

DeployIfNotExists needs a Remediation Task for EXISTING non-compliant resources. New resources are auto-remediated.

19

Azure Policy Deny = blocks deployment. Audit only logs. Neither modifies existing resources automatically.

20

Fusion rules cannot be modified. Managed entirely by Microsoft. Scheduled rules = fully customisable KQL.

Section 6 — Critical Numbers

700/1000

AZ-500 passing score

150 min

AZ-500 exam duration

40–60

AZ-500 question count

P2

Licence required: PIM, Identity Protection, Access Reviews

~2 min

Entra Connect PHS password sync

30 min

Entra Connect delta sync (objects)

90 days

KV soft-delete retention (default; min 7 days)

65500

NSG default deny-all priority

4096

NSG maximum custom priority

10 GB/day

Sentinel free data ingestion

P2 only

Defender for Servers P2 adds: JIT, FIM, VA

0 partial

Secure Score: no partial credit per security control