← Back to Portal
Crash Course
All four domains covered — conceptual depth, decision trees, and the gotchas that trip up candidates.
D1 — Identity & Access Management (25–30%)
PIM, Conditional Access, RBAC, Identity Protection, Managed Identities, SSPR
Microsoft Entra ID Authentication Methods
- MFA factors: Authenticator app (push + TOTP), FIDO2 security keys, Windows Hello, SMS, Voice
- Phishing-resistant methods: FIDO2, Windows Hello for Business, Certificate-based Auth
- Legacy auth protocols (SMTP, POP3, IMAP) cannot complete MFA — must be blocked via CA
- Authentication Strength = CA control requiring specific MFA methods (e.g., FIDO2 only)
Trap
"Block legacy authentication" is its own CA policy condition — the "Client apps" condition → Legacy authentication clients. Without blocking it, MFA policies can be bypassed.
Privileged Identity Management (PIM)
- Requires Entra ID P2. Only users who activate/approve PIM roles need P2
- Eligible assignment: user can activate up to max duration, then must re-activate
- Activation settings per role: require MFA, require justification, require approval, require ticket
- Alerts: Roles activated without MFA · Duplicate roles · etc.
- PIM now covers Azure resource roles (RBAC) AND Entra ID directory roles
- Access reviews in PIM: periodic review of group/role membership
Decision: PIM vs Direct Assignment
Use PIM when: access is occasional or high-privilege (Global Admin, Security Admin, Subscription Owner). Use permanent assignments only for service accounts or non-interactive workloads.
Conditional Access Policies
- Signal sources: User/Group, Cloud app, Location, Device platform, Sign-in/User risk
- Grant controls: Require MFA · Require compliant device · Require hybrid joined · Require approved app
- Session controls: Sign-in frequency · Persistent browser session · MCAS integration
- Exclusions always override inclusions within the same policy
- All matching policies apply — most restrictive grant control wins
- Break-glass accounts must be EXPLICITLY excluded from MFA/block policies — they bypass PIM
Trap
Named Location "All trusted locations" is a convenience exclusion. It does NOT exempt from CA policies — it only affects policies where location is the condition (e.g., skip MFA for trusted IPs). A policy excluding All trusted locations will NOT apply when signed in from a trusted Named Location.
RBAC — Scope & Role Assignment
- Scopes (broadest to narrowest): Management Group → Subscription → Resource Group → Resource
- Subnet is NOT a valid RBAC scope
- RBAC roles are additive — no conflicts except Deny assignments
- Deny assignments (from Blueprints/Policy) always override role assignments
- Custom roles: define Actions, NotActions, DataActions, NotDataActions, AssignableScopes
- NotActions subtracts from Actions — even wildcard Actions can be restricted
Managed Identities
System-Assigned
- Created with/deleted with resource
- Unique per resource
- New principal ID on resource recreation
User-Assigned
- Independent lifecycle
- Can be assigned to multiple resources
- Survives resource deletion
Identity Protection
- User risk detections: Leaked credentials, Password spray, Anomalous token
- Sign-in risk detections: Anonymous IP, Impossible travel, Atypical browser
- Risk-based CA: User risk ≥ Medium → require password change; Sign-in risk ≥ Medium → require MFA
- MFA completion satisfies CA grant but does NOT dismiss the sign-in risk event
- Administrator can dismiss or confirm compromise on a risk event
- Workload identity risk: also supports risk detection for Service Principals
SSPR (Self-Service Password Reset)
- Requires Entra ID P1 or P2 (or Microsoft 365 E3/E5)
- Privileged roles (Password Admin, User Admin, etc.) always need 2 authentication methods for SSPR
- Methods: Email, Mobile app (TOTP or notification), Phone, Security questions
- On-premises writeback requires Entra ID P1 + Entra Connect
D2 — Secure Networking (20–25%)
NSGs, Azure Firewall, WAF, DDoS, Private Endpoints, Bastion, VPN/ER
Network Security Groups (NSG)
- Applied at: subnet level AND/OR NIC level
- Evaluation: Inbound → Subnet NSG first, then NIC NSG. Outbound → NIC NSG first, then Subnet NSG
- Priority: 100–4096. Lowest number = evaluated first. First match wins (stop processing)
- Default deny-all: priority 65500 (cannot be removed)
- Service tags: VirtualNetwork, Internet, AzureLoadBalancer, Storage, Sql, AzureCloud, etc.
- ASGs (Application Security Groups): group VMs by role — use as source/destination in NSG rules
- NSG Flow Logs: capture connection tuples (5-tuple) → stored in storage account → consumed by Traffic Analytics
Azure Firewall
- Deployed in dedicated subnet: AzureFirewallSubnet (minimum /26)
- Rule types: DNAT rules (inbound NAT), Network rules (L3/L4), Application rules (L7 FQDN)
- Rule processing order: DNAT → Network → Application (exception: HTTP/HTTPS → Application first)
- Threat Intelligence: block/alert on known malicious IPs and FQDNs
- Premium-only: TLS Inspection, IDPS (Intrusion Detection/Prevention), URL filtering, Web categories
- Firewall Policy: new management model — supports rule collection groups with priorities
Trap
IDPS in Alert mode logs and alerts but DOES NOT block. Must be in "Alert and Deny" to block. IDPS requires Azure Firewall Premium SKU.
WAF (Web Application Firewall)
- Deployable on: Application Gateway, Azure Front Door, Azure CDN
- Rule sets: OWASP (CRS 3.1, 3.2), Microsoft-managed (Default Rule Set / Bot Manager)
- Modes: Detection (log only) vs Prevention (log + block)
- Custom rules: evaluated before managed rules. Actions: Allow, Block, Log, Redirect
- Exclusions: exclude specific attributes (headers, query strings, cookies, body fields) from managed rule evaluation
Private Endpoints vs Service Endpoints
| Attribute | Service Endpoint | Private Endpoint |
|---|---|---|
| Mechanism | Routing change only | Private IP in your VNet |
| Source IP seen by service | VNet source IP | Private Endpoint IP |
| Disables public endpoint | No | Yes (configurable) |
| On-premises (VPN/ER) | No | Yes |
| DNS impact | None | Requires Private DNS Zone |
| Supported services | Many PaaS | Many PaaS + 3rd party |
Azure Bastion
- Browser-based RDP/SSH (HTML5) — no public IP required on VM
- Basic SKU: same-VNet VMs only
- Standard SKU: peered VNets, native RDP/SSH client, file transfer, session recording
- Deployed in AzureBastionSubnet minimum /26
- Shareable link: enable Standard SKU to generate shareable connection URLs
VPN Gateway & ExpressRoute Security
- VPN Gateway: IPsec/IKE — encrypt traffic. Supports P2S (SSTP, IKEv2, OpenVPN) + S2S
- ExpressRoute: private dedicated circuit — NOT encrypted by default. Encrypt with MACsec or use IPsec VPN over ER
- ExpressRoute encryption (IPsec): use VPN Gateway in "ExpressRoute" mode for encryption-over-private-circuit
- Virtual WAN: hub-and-spoke managed by Microsoft — includes Secure Virtual Hub (Azure Firewall integration)
Trap
ExpressRoute traffic is NOT encrypted by default — it traverses a private MPLS circuit but is unencrypted at the IP layer. "Private circuit = encrypted" is a common misconception.
D3 — Compute, Storage & Databases (20–25%)
Key Vault, VM encryption, Storage security, SQL security, Container security
Azure Key Vault
- Two access models (mutually exclusive): Vault Access Policy OR Azure RBAC
- Switching to RBAC mode silently ignores existing access policies — things BREAK immediately
- Soft-delete: enabled by default. Deleted resources recoverable for 7–90 days (default 90)
- Purge protection: prevents permanent deletion during retention period — even Global Admins cannot purge
- Key types: RSA, EC. Operations: Encrypt, Decrypt, WrapKey, UnwrapKey, Sign, Verify
- HSM-backed keys: Premium tier uses dedicated FIPS 140-2 Level 3 HSMs
- Managed HSM: dedicated, customer-managed HSM cluster — FIPS 140-2 Level 3
Decision: Access Policy vs RBAC mode
New deployments → use RBAC mode for consistency with Azure RBAC. Legacy deployments with access policies → plan migration carefully; switching breaks all existing policies instantly.
VM & Disk Encryption
| Method | Encrypts At | Temp Disk? | Key In? |
|---|---|---|---|
| SSE Platform-Managed | Storage backend | No | Microsoft managed |
| SSE + CMK (Disk Encryption Set) | Storage backend | No | Key Vault |
| Azure Disk Encryption (ADE) | OS (BitLocker/dm-crypt) | No | Key Vault |
| Encryption at Host | Hypervisor | Yes | Key Vault or MS |
Trap — ADE and temp disk
ADE does NOT encrypt the Windows temp disk (D:) or Linux /dev/sdb. Only Encryption at Host covers the temp disk. Combine both for full coverage.
Azure Storage Security
- Default access: Shared Key (storage account key) or Entra ID (RBAC)
- Disable shared key access: forces Entra ID-only authentication — disables SAS tokens signed by key
- SAS tokens: Account SAS, Service SAS, User Delegation SAS (signed by Entra ID)
- User Delegation SAS: most secure — no key exposure; revocable via Entra permissions
- Stored Access Policy: define permissions on container — all linked SAS tokens revoked on SAP deletion
- Immutable storage: WORM (Write Once Read Many) — legal hold or time-based retention policy
- Storage firewalls: VNet service endpoints, specific public IP ranges, Trusted Azure Services exception
Azure SQL Database Security
| Control | What It Does | DBA Can Bypass? |
|---|---|---|
| TDE (at rest) | Encrypts database files | Yes — transparent to all DB users |
| Dynamic Data Masking | Masks column values in results | Yes — db_owner always sees plaintext |
| Always Encrypted | Client-side column encryption | No — DBA sees ciphertext only |
| Row-Level Security | Filters rows based on user context | Configurable — security predicate function |
| Entra ID-only auth | Disables SQL authentication | n/a |
| Advanced Threat Protection | Detects SQL injection, anomalies | n/a |
Container & AKS Security
- ACR: Private endpoint, content trust (image signing with Notary), geo-replication
- AKS authentication: Entra ID integration for kubectl access — RBAC maps to Entra ID groups
- Workload Identity (OIDC federation): pod assumes managed identity — NO secrets in pods
- Secrets Store CSI Driver: mount Key Vault secrets directly into pods as volumes
- Private cluster: AKS API server has no public endpoint — only accessible via private link
- Node OS hardening: CIS benchmark, automatic OS patching, node image upgrades
- Defender for Containers: runtime threat detection, image scanning in ACR, Kubernetes audit logs
Decision: How to give pods access to Azure resources
Use Workload Identity (OIDC federation) — pod's ServiceAccount has federated credential linked to a User-Assigned MI. NO secrets, NO shared credentials. Best practice for AKS → Azure service auth.
D4 — Security Operations (25–30%)
Defender for Cloud, Microsoft Sentinel, Azure Policy, Secure Score, KQL
Microsoft Defender for Cloud
- CSPM (Cloud Security Posture Management): recommendations, Secure Score, attack paths
- CWP (Cloud Workload Protection): per-service threat detection plans
- Free tier: basic CSPM for Azure — no threat detection. Enhanced CSPM requires paid plan
- Secure Score: % of maximum points achieved. All-or-nothing per security control (no partial credit)
- Attack Path Analysis (Enhanced CSPM): shows exploitable paths to high-value assets
- Defender CSPM: cloud security graph, data-aware security posture, external attack surface management
- Auto-provisioning: deploys MMA/AMA agents to VMs, enabling vulnerability assessment
Trap — Secure Score calculation
Fix 4 out of 5 recommendations in a control → score stays at 0 for that control. ALL must pass. Maximum points only when all pass. No partial credit.
Defender Plans Quick Reference
| Plan | Additional features beyond CSPM |
|---|---|
| Servers P2 | JIT VM access, File Integrity Monitoring, Vulnerability Assessment, AMTD |
| SQL | SQL injection detection, anomalous queries, brute force alerts |
| Storage | Malware scanning, unusual download alerts, Tor access alerts |
| Containers | ACR image scanning, runtime Kubernetes threat detection, AKS audit log analysis |
| Key Vault | Unusual access patterns, high-volume secret reads, unauthorised access attempts |
| ARM | Suspicious ARM operations — crypto mining, lateral movement via ARM |
Microsoft Sentinel
- Cloud-native SIEM + SOAR. Workspace-based (Log Analytics)
- Data connectors: Entra ID, Defender products, Syslog, CEF, REST API, Azure services
- Analytics rules: Scheduled (KQL) · NRT (Near Real-Time, ~1 min) · Microsoft Security · Fusion · ML Behaviour Analytics
- Fusion rules: ML-based multi-signal correlation — cannot be customised or disabled
- Incidents: grouping of related alerts. Investigated via Investigation graph
- Playbooks: Azure Logic Apps triggered on incident/alert creation
- UEBA (User and Entity Behaviour Analytics): requires Entra ID data connector + Insights package
- Threat Intelligence: import indicators (IP, domain, file hash) via TAXII or Graph API
Azure Policy
- Effects (processing order): Disabled → Append → Audit → AuditIfNotExists → Deny → DeployIfNotExists → Modify
- Deny: blocks the deployment of non-compliant resources. Does not affect existing resources
- DeployIfNotExists: deploys a related resource/configuration when the policy is met. Requires managed identity with RBAC
- Remediation tasks: manually triggered to fix EXISTING non-compliant resources (DeployIfNotExists/Modify)
- Initiatives: group of policies. Applied together to simplify management
- Exemptions: resource/RG-scoped exceptions to policy assignments. Include expiry date and category (Waiver/Mitigated)
Trap — DeployIfNotExists and existing resources
DeployIfNotExists auto-remediates NEW resources. EXISTING non-compliant resources require a Remediation Task. Without creating the task, existing resources stay non-compliant despite the policy assignment.
JIT VM Access
- Requires Defender for Servers P2
- Mechanism: NSG rules block RDP/SSH by default; JIT adds time-limited NSG allow rules when requested
- Users request access via Defender for Cloud or Azure portal, specifying IP and duration
- All access requests are logged in Azure Activity Log
- Reduces attack surface: RDP/SSH is not permanently open
KQL Essentials for AZ-500
-- Filter time and count by field
SignInLogs
| where TimeGenerated > ago(7d) and ResultType != 0
| summarize count() by UserPrincipalName
-- Join two tables
SignInLogs
| where TimeGenerated > ago(1d)
| join kind=inner (
AuditLogs | where TimeGenerated > ago(1d)
) on $left.CorrelationId == $right.CorrelationId
-- Parse dynamic JSON column
SecurityAlert
| extend Entities = parse_json(Entities)
| mv-expand Entities
| project TimeGenerated, AlertName, Entities
-- Detect brute force (5+ failures within 10 minutes)
SecurityEvent
| where EventID == 4625
| summarize FailCount = count() by Account, IPAddress, bin(TimeGenerated, 10m)
| where FailCount >= 5
-- Recent role assignments
AzureActivity
| where OperationNameValue =~ "MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE"
| where ActivityStatusValue == "Success"
| project TimeGenerated, Caller, ResourceGroup