/azure-security-engineer

Notes for the AZ-500: Microsoft Azure Security Technologies exam.

Exam AZ-500

Manage Identity and Access

Manage Azure Active Directory (Azure AD) Identities

  1. Create and manage a managed identity for Azure resources

  2. Manage Azure AD groups

    • A group is a collection of users. Types of groups include:

      • Security Group
      • Office 365 Group

    • Membership types for security groups include:

      • Assigned: The administrator adds or remove members.
      • Dynamic User: Membership determined based on attribute values. Queries determine which attributes are used to determine group membership.
      • Dynamic Device (security groups only)

    • Security groups can be nested. However, there are some restrictions on nested groups. You cannot:

      • Add groups to groups synced with on-premises Active Directory.
      • Add security groups to Office 365 groups.
      • Add Office 365 groups to other Office 365 groups or to security groups.
      • Assign apps to nested groups.
      • Apply licenses to nested groups.

    • Groups can be managed via:

      • Azure Portal
      • Azure PowerShell
      • Azure CLI

    • To create a group in PowerShell:

      New-AzADGroup -DisplayName "Sales" -MailNickname "Sales"

    • To create a group using the CLI:

      az ad group create --display-name "Marketing" --mail-nickname "Marketing"

  3. Manage Azure AD users

    • A user is an account required to access Azure resources. This includes Software as a Service (SaaS) applications such as Office 365, as well as custom applications written by your in-house development team.

    • A user can be one of:

      • Cloud based user account (Azure Active Directory)
      • A synchronised on-premises directory account
      • A guest user

    • Users can be managed via:

      • Azure Portal
      • Azure PowerShell
      • Azure CLI

    • To create a user in PowerShell:

      $SecureStringPassword = ConvertTo-SecureString -String "Password.1" -AsPlainText -Force
New-AzADUser -DisplayName "Test User2" -UserPrincipalName "testuser2@sjohnsontexansfans.onmicrosoft.com" -Password $SecureStringPassword -MailNickname testuser2

    • To create a user using the CLI:

      az ad user create --display-name "Test User3" --password "Password.1" --user-principal-name testuser3@sjohnsonexansfans.onmicrosoft.com

  4. Manage external identities by using Azure AD

  5. Manage administrative units

Manage Secure Access by Using Azure AD

  1. Configure Azure AD Privileged Identity Management (PIM)

  2. Implement Conditional Access policies, including multifactor authentication

  3. Implement Azure AD Identity Protection

  4. Implement passwordless authentication

  5. Configure access reviews

Manage Application Access

  1. Integration single sign-on (SSO) and identity providers for authentication

  2. Create an app registration

  3. Configure app registration permission scopes

  4. Manage app registration permission consent

  5. Manage API permissions to Azure subscriptions and resources

  6. Configure an authentication method for a service principal

Manage Access Control

  1. Configure Azure role permissions for management groups, subscriptions, resource groups, and resources

  2. Interpret role and resource permissions

  3. Assign built-in Azure AD roles

  4. Create and assign custom roles, including Azure roles and Azure AD roles

Implement Platform Protection

Implement Advanced Network Security

  1. Secure the connectivity of hybrid networks

  2. Secure the connectivity of virtual networks

  3. Create and configure Azure Firewall

  4. Create and configure Azure Firewall Manager

  5. Create and configure Azure Application Gateway

  6. Create and configure Azure Front Door

  7. Create and configure Web Application Firewall (WAF)

  8. Create a resource firewall, including storage account, Azure SQL, Azure Key Vault, or Azure App Service

  9. Configure network isolation for Web Apps and Azure Functions

  10. Implement Azure Service Endpoints

  11. Implement Azure Private Endpoints, including integrating with other services

  12. Implement Azure Private Links

  13. Implement Azure DDoS Protection

Configure Advanced Security for Compute

  1. Configure Azure Endpoint Protection for virtual machines (VMs)

  2. Implement and manage security updates for VMs

  3. Configure security for container services

  4. Manage access to Azure Container Registry

  5. Configure security for serverless compute

  6. Configure security for an Azure App Service

  7. Configure encryption at rest

  8. Configure encryption in transit

Manage Security Operations

Configure Centralised Policy Management

  1. Configure a custom security policy

  2. Create a policy initiative

  3. Configure security settings and auditing by using Azure Policy

Configure and Manage Threat Protection

  1. Configure Azure Defender for servers (not including Microsoft Defender for Endpoint)

  2. Evaluate vulnerability scans from Azure Defender

  3. Configure Azure Defender for SQL

  4. Use the Microsoft Threat Modelling Tool

Configure and Manage Security Monitoring Solutions

  1. Create and customise alert rules by using Azure Monitor

  2. Configure diagnostic logging and log retention by using Azure Monitor

  3. Monitor security logs by using Azure Monitor

  4. Create and customise alert rules in Azure Sentinel

  5. Configure connections in Azure Sentinel

  6. Evaluate alerts and incidents in Azure Sentinel

Secure Data and Applications

Configure Security for Storage

  1. Configure access control for storage accounts

  2. Configure storage account access keys

  3. Configure Azure AD authentication for Azure Storage and Azure Files

  4. Configure delegated access

Configure Security for Data

  1. Enable database authentication by using Azure AD

  2. Enable database auditing

  3. Configure dynamic masking on SQL workloads

  4. Implement database encryption for Azure SQL Database

  5. Implement network isolation for data solutions, including Azure Synapse Analytics and Azure Cosmos DB

Configure and Manage Azure Key Vault

  1. Create and configure Key Vault

  2. Configure access to Key Vault

  3. Manage certificates, secrets, and keys

  4. Configure key rotation

  5. Configure backup and recovery of certificates, secrets, and keys