AZ-500 Azure Security Technologies Study Guide

I passed my Az-500 exam in January 2020. The exam consisted of around 50 MCQs and 1 case study, and had a time limit of 3 hours. You can find my Azure Security Engineer Badge here :

Microsoft Certified: Azure Security Engineer Associate was issued by Microsoft to Mohommed Rimaz…

What follows is the study guide I created based on the exam skills outline to help me prepare. Hope this helps you too. Cheers!

Manage identity and access (30–35%)

Manage Azure Active Directory identities

Configure security for service principals

• https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal

Manage Azure AD directory groups | Manage Azure AD users

• https://docs.microsoft.com/en-us/learn/modules/manage-users-and-groups-in-aad/
• https://docs.microsoft.com/en-us/learn/modules/create-users-and-groups-in-azure-active-directory/

Configure password writeback

• https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback

Configure authentication methods including password hash and Pass Through Authentication (PTA), OAuth, and passwordless

• https://docs.microsoft.com/en-us/azure/active-directory/hybrid/choose-ad-authn
• https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta
• https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-quick-start
• https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs
• https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization
• https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-aad
• https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless

Transfer Azure subscriptions between Azure AD tenants

• https://docs.microsoft.com/en-us/azure/role-based-access-control/transfer-subscription

Configure secure access by using Azure AD

Monitor privileged access for Azure AD Privileged Identity Management (PIM)

• https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-add-role-to-user?tabs=new
• https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-configure-security-alerts?tabs=new

Configure Access Reviews

• https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-start-security-review

Activate and configure PIM

• https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-deployment-plan
• https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

Implement Conditional Access policies including Multi-Factor Authentication (MFA)

• https://docs.microsoft.com/en-us/learn/modules/secure-aad-users-with-mfa/
• https://docs.microsoft.com/en-us/learn/modules/allow-users-reset-their-password/

Configure Azure AD identity protection

• https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
• https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies
• https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies

Manage application access

Create App Registration

• https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app

Configure App Registration permission scopes

• https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-expose-web-apis
• https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-access-web-apis

Manage App Registration permission consent

• https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent?tabs=azure-portal
• https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/manage-consent-requests
• https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent
• https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/manage-app-consent-policies
• https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/manage-application-permissions

Manage API access to Azure subscriptions and resources

• https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal

Manage access control

Configure subscription and resource permissions | configure resource group permissions

• https://docs.microsoft.com/en-us/learn/modules/control-and-organize-with-azure-resource-manager/
• https://docs.microsoft.com/en-us/learn/modules/secure-azure-resources-with-rbac/
• https://docs.microsoft.com/en-us/learn/modules/manage-subscription-access-azure-rbac/

Configure custom RBAC roles

• https://docs.microsoft.com/en-us/learn/modules/create-custom-azure-roles-with-rbac/

Identify the appropriate role | apply principle of least privilege | interpret permissions

• https://docs.microsoft.com/en-us/azure/role-based-access-control/role-definitions
• https://docs.microsoft.com/en-us/azure/role-based-access-control/scope-overview
• https://docs.microsoft.com/en-us/azure/role-based-access-control/best-practices

Check access

• https://docs.microsoft.com/en-us/azure/role-based-access-control/check-access

Implement platform protection (15–20%)

Implement advanced network security

Secure the connectivity of virtual networks (VPN authentication, Express Route encryption) 

• https://docs.microsoft.com/en-us/learn/modules/configure-network-for-azure-virtual-machines/

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs) | Implement Service Endpoints

• https://docs.microsoft.com/en-us/learn/modules/secure-and-isolate-with-nsg-and-service-endpoints/

Create and configure Azure Firewall 

• https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal

Implement Azure Firewall Manager 

• https://docs.microsoft.com/en-us/azure/firewall-manager/overview
• https://docs.microsoft.com/en-us/azure/firewall-manager/policy-overview
• https://docs.microsoft.com/en-us/azure/firewall-manager/deployment-overview

Configure Azure Front Door service as an Application Gateway 

• https://docs.microsoft.com/en-us/azure/frontdoor/front-door-overview
• https://docs.microsoft.com/en-us/azure/frontdoor/quickstart-create-front-door

Configure a Web Application Firewall (WAF) on Azure Application Gateway  configure Azure Bastion 

• https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal
• https://docs.microsoft.com/en-us/azure/bastion/bastion-overview
• https://docs.microsoft.com/en-us/azure/bastion/tutorial-create-host-portal

Configure a firewall on a storage account, Azure SQL, KeyVault, or App Service

• https://docs.microsoft.com/en-us/azure/key-vault/general/network-security
• https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal
• https://docs.microsoft.com/en-us/azure/azure-sql/database/secure-database-tutorial

Implement DDoS protection

• https://docs.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview
• https://docs.microsoft.com/en-us/azure/ddos-protection/manage-ddos-protection

Configure advanced security for compute

Configure endpoint protection 

• https://docs.microsoft.com/en-us/learn/modules/secure-vms-with-azure-security-center/

Configure and monitor system updates for VMs 

• https://docs.microsoft.com/en-us/learn/modules/manage-azure-updates/

Configure authentication for Azure Container Registry 

• https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication

Configure security for different types of containers

• https://docs.microsoft.com/en-us/azure/container-instances/container-instances-image-security

Implement vulnerability management 

• https://docs.microsoft.com/en-us/azure/security-center/deploy-vulnerability-assessment-vm

Configure isolation for AKS 

• https://docs.microsoft.com/en-us/learn/modules/intro-to-azure-kubernetes-service/
• https://docs.microsoft.com/en-us/azure/aks/concepts-security

Configure security for container registry 

• https://docs.microsoft.com/en-us/azure/container-registry/security-baseline

Implement Azure Disk Encryption 

• https://docs.microsoft.com/en-us/learn/modules/secure-your-azure-virtual-machine-disks/

Configure authentication and security for Azure App Service

• https://docs.microsoft.com/en-us/learn/modules/secure-aspnet-core-identity/

Configure SSL/TLS certs 

• https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate
• https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings

Configure authentication for Azure Kubernetes Service 

• https://docs.microsoft.com/en-us/azure/aks/managed-aad

Configure automatic updates

• https://docs.microsoft.com/en-us/azure/automation/update-management/deploy-updates

Manage security operations (25–30%)

Monitor security by using Azure Monitor

Create and customize alerts 

• https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-overview
• https://docs.microsoft.com/en-us/learn/modules/incident-response-with-alerting-on-azure/

Monitor security logs by using Azure Monitor 

• https://docs.microsoft.com/en-us/learn/modules/resolve-threats-with-azure-security-center/

Configure diagnostic logging and log retention

• https://docs.microsoft.com/en-us/learn/modules/capture-application-logs-app-service/

Monitor security by using Azure Security Center

Evaluate vulnerability scans from Azure Security Center

• https://docs.microsoft.com/en-us/azure/security-center/remediate-vulnerability-findings-vm

Configure Just in Time VM access by using Azure Security Center 

• https://docs.microsoft.com/en-us/learn/modules/secure-vms-with-azure-security-center/

Configure centralized policy management by using Azure Security Center

• https://docs.microsoft.com/en-us/learn/modules/identify-threats-with-azure-security-center/

Configure compliance policies and evaluate for compliance by using Azure Security Center

• https://docs.microsoft.com/en-us/learn/modules/create-security-baselines/3-create-an-azure-security-center-baseline

Monitor security by using Azure Sentinel

Create and customize alerts | Configure data sources to Azure Sentinel | Evaluate results from Azure Sentinel

• https://docs.microsoft.com/en-us/learn/modules/intro-to-azure-sentinel/
• https://docs.microsoft.com/en-us/azure/sentinel/connect-data-sources
• https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom

Configure workflow automation by using Azure Sentinel

• https://docs.microsoft.com/en-us/learn/modules/threat-response-sentinel-playbooks/

Configure security policies

Configure security settings by using Azure Policy 

• https://docs.microsoft.com/en-us/learn/modules/control-and-organize-with-azure-resource-manager/4-use-policies-to-enforce-standards

Configure security settings by using Azure Blueprint 

• https://docs.microsoft.com/en-us/learn/modules/build-cloud-governance-strategy-azure/

Configure a playbook by using Azure Sentinel

• https://docs.microsoft.com/en-us/learn/modules/threat-response-sentinel-playbooks/

Secure data and applications (20–25%)

Configure security for storage

Configure access control for storage accounts 

• https://docs.microsoft.com/en-us/azure/storage/blobs/authorize-data-operations-portal
• https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-portal?toc=/azure/storage/blobs/toc.json

Configure key management for storage accounts 

• https://docs.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-key-vault?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&tabs=portal

Configure Azure AD authentication for Azure Storage 

• https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-msi?toc=/azure/storage/blobs/toc.json

Configure Azure AD Domain Services authentication for Azure Files 

• https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-domain-service-enable?tabs=azure-portal

Create and manage Shared Access Signatures (SAS) 

• https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

Create a shared access policy for a blob or blob container 

• https://docs.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy

Configure Storage Service Encryption

• https://docs.microsoft.com/en-us/learn/modules/create-security-baselines/4-create-a-storage-accounts-baseline

Configure Azure Defender for Storage

• https://docs.microsoft.com/en-us/azure/storage/common/azure-defender-storage-configure?tabs=azure-security-center

Configure security for databases

Enable database authentication 

• https://docs.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?tabs=azure-powershell

Enable database auditing 

• https://docs.microsoft.com/en-us/learn/modules/create-security-baselines/5-create-an-azure-sql-database-baseline

Configure Azure Defender for SQL 

• https://docs.microsoft.com/bs-cyrl-ba/Azure/azure-sql/database/azure-defender-for-sql

Configure Azure SQL Database Advanced Threat Protection 

• https://docs.microsoft.com/bs-cyrl-ba/Azure/azure-sql/database/threat-detection-configure

Implement database encryption 

• https://docs.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-tde-overview?tabs=azure-portal

Implement Azure SQL Database Always Encrypted

• https://docs.microsoft.com/en-us/azure/azure-sql/database/always-encrypted-azure-key-vault-configure?tabs=azure-powershell

Configure and manage Key Vault

Manage access to Key Vault 

• https://docs.microsoft.com/en-us/learn/modules/manage-secrets-with-azure-key-vault/

Manage permissions to secrets, certificates, and keys | Manage certificates | Manage secrets

• https://docs.microsoft.com/en-us/learn/modules/configure-and-manage-azure-key-vault/

Configure RBAC usage in Azure Key Vault 

• https://docs.microsoft.com/en-us/azure/key-vault/general/secure-your-key-vault

Configure key rotation 

• https://docs.microsoft.com/en-us/azure/key-vault/secrets/tutorial-rotation-dual

Backup and restore of Key Vault items 

• https://docs.microsoft.com/en-us/azure/key-vault/general/backup
• https://docs.microsoft.com/en-us/azure/key-vault/general/key-vault-recovery?tabs=azure-portal

Configure Azure Defender for Key Vault

• https://docs.microsoft.com/en-us/azure/security-center/defender-for-key-vault-introduction