Cloud security | Microsoft

Term: Microsoft Entra - Core Role

Definition: The identity and access management gatekeeper. Answers: "Who are you and what do you have access to?" (Formerly Azure AD).

Term: Entra Conditional Access

Definition: The "If / Then" engine. Evaluates signals (location, risk, device compliance) to block access or demand MFA.

Term: Entra PIM (Privileged Identity Management)

Definition: Just-In-Time (JIT) access. Gives admins high-level power for a short window with manager approvals instead of permanent admin rights.

Term: Entra Agent ID

Definition: Identity management and security policies applied specifically to autonomous AI agents and bots.

Term: Entra Entitlement Management

Definition: Uses "Access Packages" to bundle access to multiple apps, groups, and sites for internal users or contractors in one click.

Term: Microsoft Defender - Core Role

Definition: Threat detection and posture management. The internal security guard walking around looking for bad configurations or active hackers.

Term: Defender XDR

Definition: Protects workplace tools like endpoints (laptops/phones), email/Teams (Office 365), on-prem Active Directory, and cloud apps (CASB).

Term: Defender for Cloud - CSPM (Posture Management)

Definition: The audit checklist. Scans Azure, AWS, and GCP configurations to calculate a Secure Score and find exposed storage or open ports.

Term: Defender for Cloud - CWPP (Workload Protection)

Definition: Real-time threat detection for cloud servers (VMs), SQL databases, and storage accounts.

Term: Azure AI Content Safety / Defender for AI

Definition: AI guardrail. Scans inputs and outputs on OpenAI models to block jailbreak prompts, prompt injections, and harmful generated text.

Term: Microsoft Sentinel - Core Role

Definition: Cloud-native SIEM and SOAR (Control Tower). Collects logs from EVERYTHING (Microsoft, Cisco, AWS, Linux).

Term: KQL (Kusto Query Language)

Definition: The search language used inside Microsoft Sentinel to query and hunt for threats across billions of log lines.

Term: Sentinel Playbooks (Logic Apps)

Definition: Automated incident response workflows (SOAR) that can instantly block an IP or disable a compromised account without human intervention.

Term: Microsoft Purview - Core Role

Definition: Data protection and governance. Puts an armored envelope around the data itself, regardless of where it travels.

Term: Purview Sensitivity Labels

Definition: Encrypts and watermarks files based on content (e.g., CONFIDENTIAL). If emailed externally, the file remains locked and encrypted.

Term: Purview DLP (Data Loss Prevention)

Definition: Prevents accidental leaks by blocking users from typing credit card numbers or SSNs into web forms, chats, or unapproved apps.

Term: Microsoft Intune

Definition: Mobile Device Management (MDM) and Mobile App Management (MAM). Ensures company laptops/phones are encrypted, compliant, and can be remotely wiped if lost.

🏛 Domain 1: Manage Identity, Access, and Governance (20–25%)

1. Microsoft Entra ID & Access Controls

• Authentication: Passwordless (FIDO2, Microsoft Authenticator), Multi-Factor Authentication (MFA), and OAuth permission grants/consent settings.

• Conditional Access: Evaluates signals (User Risk, Sign-in Risk, Device Compliance, Location, App Sensitivity).

• Entra Agent ID: Managed identities specifically for autonomous AI agents and Copilot Studio bots. Focus on applying Conditional Access to AI agents and analyzing an agent's blast radius using Defender XDR.

• Privileged Identity Management (PIM): Just-In-Time (JIT) access, mandatory approval workflows, time-bound role activations, and MFA triggers.

• Managed Identities: System-assigned vs. User-assigned. Eliminates hardcoded credentials in code when Azure resources talk to each other.

2. Azure Key Vault

• Access Control: RBAC vs. Key Vault Access Policies.

• Perimeter Security: Key Vault Firewall & Private Endpoints.

• Protection: Soft Delete, Purge Protection, Customer-Managed Keys (CMK), and secret scanning with Defender CSPM.

3. Governance & Regulatory Compliance

• Azure Policy & Blueprints: Enforces preventive/detective rules across Azure subscriptions.

• RBAC Granularity: Built-in vs. Custom Roles, Scope inheritance (Management Group $\rightarrow$ Subscription $\rightarrow$ Resource Group $\rightarrow$ Resource).

• Resource Locks: CanNotDelete vs. ReadOnly.

🛡 Domain 2: Secure Storage, Databases, and Networking (25–30%)

1. Storage Account Security

• Network Isolation: Service Endpoints vs. Private Endpoints, disabling public network access, and Storage Account Firewalls.

• Access Controls: Shared Key access vs. Entra ID authentication (Azure RBAC for Blob/Queue), Shared Access Signatures (SAS) with stored access policies.

• Threat Protection: Defender for Storage (scans for malware uploads and sensitive data exposure).

2. Database Security (Azure SQL & Managed Instances)

• Platform Security: T-SQL Transparent Data Encryption (TDE), Dynamic Data Masking (DDM), Always Encrypted, and Azure SQL Firewall.

• Auditing & Protection: SQL Auditing to Log Analytics, and Defender for Databases for anomaly detection.

3. Network Infrastructure

• Traffic Control:

  • NSGs (Network Security Groups): Layer 4 filtering (Subnet & NIC level).

  • ASGs (Application Security Groups): Grouping VMs into logical application tiers for simplified NSG rules.

• Perimeter & Transit:

  • Azure Firewall: Layer 3–7 network and application rules.

  • Azure Web Application Firewall (WAF): HTTP/S protection on Azure Front Door / Application Gateway (OWASP Top 10).

  • Azure Virtual WAN & AVNM: Centralized routing, security hub topologies, and Virtual Network Manager access policies.

  • Entra Private Access: ZTNA (Zero Trust Network Access) replacement for legacy VPNs.

🤖 Domain 3: Secure Compute and AI Workloads (20–25%)

1. Virtual Machines & Hybrid Servers

• Management & Access: Azure Bastion (browser-based RDP/SSH without public IPs), Just-in-Time (JIT) VM Access, and Azure Arc (extending security to on-prem/AWS/GCP VMs).

• Hardware & Runtime Protection: Disk Encryption (ADE / Server-side encryption), Trusted Launch (vTPM, Secure Boot), Integrity Monitoring, and Azure Machine Configuration.

• Vulnerability Scanning: Agentless VM scanning vs. Defender for Servers extension.

2. Containers & Application Platform Services

• Container Security: Image vulnerability scanning in Azure Container Registry (ACR), AKS cluster hardening, and Azure Container Apps network isolation.

• App Services & Serverless: Securing App Services, Azure Functions, Logic Apps, and protecting back-end APIs with Azure API Management (APIM).

3. Generative AI & Azure OpenAI / Foundry Security

• AI Guardrails:

  • Azure AI Content Safety: Real-time screening for hate, self-harm, sexual, violence, and jailbreak / prompt injection attacks.

  • AI Gateway in APIM: Placing API Management in front of Azure AI Foundry to limit rate tokens, route prompts, and inspect traffic.

• Data Security & Privacy:

  • Ensuring tenant data is isolated and never used to train base foundation models.

  • Purview DSPM (Data Security Posture Management): Spotting overexposed SharePoint data and risks in Copilot / AI apps.

• Real-time Monitoring: Defender for AI Services for monitoring prompt anomalies and agent behaviors.

📊 Domain 4: Manage and Monitor Security Posture (20–25%)

1. Microsoft Defender for Cloud

• CSPM (Cloud Security Posture Management): Calculating Secure Score, identifying misconfigurations, evaluating regulatory compliance standards (NIST, ISO 27001), and agentless multicloud connectors (AWS/GCP).

• CWPP (Cloud Workload Protection): Defender for Servers, Databases, Storage, Key Vault, Containers, and AI.

2. Microsoft Sentinel (SIEM & SOAR)

• Log Ingestion: Workspaces, Data Connectors, Data Collection Rules (DCR), Syslog/CEF event collection, and Windows Security Events (WEF).

• KQL (Kusto Query Language):

  • where: Filters logs by condition.

  • summarize: Aggregates metrics (count(), avg(), dcount()).

  • project: Selects specific columns to display.

  • join: Combines logs (e.g., matching Sign-in logs with Audit logs).

• SOAR: Automation Rules & Playbooks (Azure Logic Apps) for automated incident response.

3. Microsoft Security Copilot

• Workspace & RBAC: Configuring Security Copilot workspaces and role permissions.

• Plugins & Agents: Integrating plugins (Sentinel, Defender XDR, Purview, Intune) and executing Microsoft agents for automated threat investigation.

💡 Quick Scenario Cheat Rules for SC-500