Skip to content
Certification Guides

MCA Microsoft Certified Associate Azure Security Engineer Study Guide: Exam AZ-500 (2022)

MCA Microsoft Certified Associate Azure Security Engineer Study Guide: Exam AZ-500 (2022) simplifies exam prep with well-structured content and practice questions.

Preview 31 of 489 pages

See the first 31 pages exactly as they appear in the document.

  1. Page 1
  2. Page 2
  3. Page 3
    Read page 3 as text

    Table of Contents Cover Title Page Copyright Acknowledgments About the Author About the Technical Editor Introduction What Does This Book Cover? Who Should Read This Book Study Guide Features Interactive Online Learning Environment and Test Bank Additional Resources MCA Azure Security Engineer Study Guide Exam Objectives Objective Map How to Contact Wiley or the Author Assessment Test Answers to Assessment Test Chapter 1: Introduction to Microsoft Azure What Is Microsoft Azure? Cloud Environment Security Objectives Common Security Issues The AAAs of Access Management Encryption Network Segmentation Cybersecurity Considerations for the Cloud Environment Major Cybersecurity Threats Summary

  4. Page 4
    Read page 4 as text

    Exam Essentials Review Questions Chapter 2: Managing Identity and Access in Microsoft Azure Identity and Access Management IAM in the Microsoft Azure Platform Managing Application Access Managing Access Control Summary Exam Essentials Review Questions Chapter 3: Implementing Platform Protections Implementing Advanced Network Security Configuring Enhanced Security for Compute Exam Essentials Review Questions Chapter 4: Managing Security Operations Configure Centralized Policy Management Configuring and Managing Threat Protection Configuring and Managing Security Monitoring Solutions Summary Exam Essentials Review Questions Chapter 5: Securing Data and Applications Configuring Security for Storage in Azure Summary Exam Essentials Review Questions Appendix A: An Azure Security Tools Overview Chapter 2, “Managing Identity and Access on Microsoft

  5. Page 5
    Read page 5 as text

    Azure” Chapter 3, “Implementing Platform Protections” Chapter 4, “Managing Security Operations” Chapter 5, “Securing Data and Applications” Appendix B: Answers to Review Questions Chapter 1: Introduction to Microsoft Azure Chapter 2: Managing Identity and Access in Microsoft Azure Chapter 3: Implementing Platform Protections Chapter 4: Managing Security Operations Chapter 5: Securing Data and Applications Index End User License Agreement List of Tables Chapter 2 TABLE 2.1 Differences between system-assigned and user- assigned managed iden... TABLE 2.2 PIM terminology TABLE 2.3 Breakdown of identity access roles TABLE 2.4 Examples of built-in Azure roles TABLE 2.5 Breakdown of the custom role properties Chapter 3 TABLE 3.1 Setting options for your Front Door application TABLE 3.2 Setting options for your backend pools TABLE 3.3 Settings for creating a WAF TABLE 3.4 Basic settings for creating a private link service TABLE 3.5 Outbound settings for a private link service TABLE 3.6 Settings for linking to a private endpoint

  6. Page 6
    Read page 6 as text

    TABLE 3.7 Settings for the Resource values in a private endpoint TABLE 3.8 Configuration settings for a private endpoint TABLE 3.9 Steps to configure Microsoft Endpoint Protection TABLE 3.10 Microsoft Defender for Cloud features TABLE 3.11 Features that handle inbound and outbound requests to your applic... TABLE 3.12 Microsoft inbound use case recommendations TABLE 3.13 Microsoft outbound use case recommendations Chapter 4 TABLE 4.1 Threat modeling tools TABLE 4.2 Activity log alert severity levels TABLE 4.3 Various platform log types and descriptions TABLE 4.4 Various log destinations and descriptions TABLE 4.5 Features of Azure Monitor Logs TABLE 4.6 Azure Monitor Metrics features and descriptions TABLE 4.7 The built-in Microsoft Sentinel rules and their descriptions Chapter 5 TABLE 5.1 Various storage accounts and their usage TABLE 5.2 Migration scenario breakdown TABLE 5.3 Built-in share-level permissions ( https://docs.microsoft.com/en-us ... TABLE 5.4 Users and their definitions TABLE 5.5 Calling the Get User Delegation Key operation TABLE 5.6 Specifying the local hostname and blob service port TABLE 5.7 Request headers

  7. Page 7
    Read page 7 as text

    TABLE 5.8 Supported fields when creating a user delegation SAS token ( https: ... TABLE 5.9 DDM rule descriptions TABLE 5.10 Settings for creating a network security group in Azure TABLE 5.11 Benefits of Cosmos DB TABLE 5.12 Benefits of Azure Synapse Link TABLE 5.13 Roles supported by Azure Key Vault Appendix A TABLE A.1 Rule collection groups TABLE A.2 Various Azure-supported storage accounts and their breakdown TABLE A.3 Summary of Azure Cosmo's benefits and features TABLE A.4 Azure Synapse Analytics Features TABLE A.5 Key benefits of using Azure Synapse Links List of Illustrations Chapter 1 FIGURE 1.1 The CIA triad FIGURE 1.2 Defense in depth FIGURE 1.3 Symmetric encryption FIGURE 1.4 Asymmetric encryption FIGURE 1.5 A DMZ setup FIGURE 1.6 Sample phishing email FIGURE 1.7 How botnets work Chapter 2 FIGURE 2.1 Enabling a system-assigned managed identity on

  8. Page 8
    Read page 8 as text

    a VM FIGURE 2.2 Adding a user-assigned managed identity FIGURE 2.3 Guest Invite Settings FIGURE 2.4 How conditional access policies work FIGURE 2.5 Benefits of passwordless authentication FIGURE 2.6 Naming your access review FIGURE 2.7 Selecting an end for your access review FIGURE 2.8 Enabling notification FIGURE 2.9 Additional Content for Reviewer Email FIGURE 2.10 Security principals FIGURE 2.11 Levels of scope FIGURE 2.12 Custom roles Chapter 3 FIGURE 3.1 How VPN tunneling works FIGURE 3.2 How an Azure firewall works FIGURE 3.3 Creating an application gateway FIGURE 3.4 Adding a public IP address FIGURE 3.5 The contoso-frontend FIGURE 3.6 Adding a backend FIGURE 3.7 Click Add to complete the configuration. FIGURE 3.8 Specify the domain to route requests to FIGURE 3.9 Create the backend pool. FIGURE 3.10 Azure backbone explained FIGURE 3.11 Adding a service endpoint to your subnet FIGURE 3.12 How service endpoints control information flow

  9. Page 9
    Read page 9 as text

    FIGURE 3.13 How Update Management works in Azure FIGURE 3.14 Results from the latest update assessment FIGURE 3.15 Choosing update deployments FIGURE 3.16 Azure's shared responsibility matrix FIGURE 3.17 How app-assigned addressing works FIGURE 3.18 Inbound access restrictions FIGURE 3.19 Gateway-required VNet integration FIGURE 3.20 Azure ExpressRoute Chapter 4 FIGURE 4.1 Vulnerability Assessment findings FIGURE 4.2 Clicking Scan in the Vulnerability Assessment tool FIGURE 4.3 Vulnerability Scan report findings FIGURE 4.4 Threat modeling tool preview FIGURE 4.5 Data visualization FIGURE 4.6 Creating alert rules FIGURE 4.7 Choosing advanced options FIGURE 4.8 Selecting a resource FIGURE 4.9 Destination Details FIGURE 4.10 Custom metrics FIGURE 4.11 Metric database data chart FIGURE 4.12 Changing the time range FIGURE 4.13 SOAR and SIEM elements in Azure FIGURE 4.14 Creating incident alerts Chapter 5 FIGURE 5.1 Granting access to Azure file resources with Azure AD credentials...

  10. Page 10
    Read page 10 as text

    FIGURE 5.2 Audit log info FIGURE 5.3 Security Insights FIGURE 5.4 Data masking FIGURE 5.5 Various category controls FIGURE 5.6 Azure Firewall FIGURE 5.7 Network isolation through ACLs FIGURE 5.8 Azure Synapse Link for Cosmos FIGURE 5.9 RBAC in Azure Key Vault FIGURE 5.10 Creating a key rotation policy FIGURE 5.11 Configuring a rotation policy Appendix A FIGURE A.1 Components of a firewall policy FIGURE A.2 Secure hubs configuration FIGURE A.3 Web Application Firewall FIGURE A.4 Preventing data leakage FIGURE A.5 Azure Synapse

  11. Page 11
    Read page 11 as text

    MCA Microsoft Certified Associate Azure Security Engineer Study Guide Exam AZ-500 Shimon Brathwaite

  12. Page 12
  13. Page 13
    Read page 13 as text

    Copyright © 2023 by John Wiley & Sons, Inc. All rights reserved. Published by John Wiley & Sons, Inc., Hoboken, New Jersey. Published simultaneously in Canada and the United Kingdom. ISBN: 978-1-119-87037-1 ISBN: 978-1-119-87039-5 (ebk.) ISBN: 978-1-119-87038-8 (ebk.) No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 750-4470, or on the web at www.copyright.com . Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at www.wiley.com/go/permission . Trademarks: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. Microsoft and Azure are registered trademarks of Microsoft Corporation. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book. Microsoft Certified Associate Azure Security Engineer Study Guide is an independent publication and is neither affiliated with, nor authorized, sponsored, or approved by, Microsoft Corporation. Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Further, readers should be aware that websites listed in this work may have changed or disappeared between when this work was written and when it is read. Neither the publisher nor authors shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages. For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002. Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic formats. For more information about Wiley products, visit our web site at www.wiley.com . Library of Congress Control Number: 2022945256 Cover image: © Jeremy Woodhouse/Getty Images Cover design: Wiley

  14. Page 14
    Read page 14 as text

    Acknowledgments I have had the pleasure of working with professionals from Wiley to create this study guide. I would like to thank Kenyon Brown, senior acquisitions editor, for recruiting me and working with me to get my proposal approved for production. He was very helpful in helping me to understand the requirements and getting started with writing the book. I would like to thank Christine O'Connor and Janette Neal, who oversaw the edits for my book. They are extremely helpful in making sure that my book was up to Wiley's production standards and helped to coordinate my interactions with everyone else on the team. I am very grateful for Magesh Elangovan, who worked as the content refinement specialist. He helped me to ensure that the quality of the images and overall content of the book was appropriate for all readers and that the ideas of the book will be conveyed clearly to all readers. Lastly, I would like to thank Mahalingam, the technical editor who helped me refine the book's content. He was extremely knowledgeable on Microsoft Azure and provided excellent feedback on technical concepts that helped me to improve the overall quality of the book.

  15. Page 15
    Read page 15 as text

    About the Author Shimon Brathwaite is author and editor-in-chief of securitymadesimple.org , a website dedicated to teaching business owners how to secure their businesses and helping cybersecurity professionals start and advance their careers. Before starting his career in cybersecurity, Shimon was a co-op student at Toronto Metropolitan University in Toronto, Canada, where he received a degree in their Business Technology Management program before deciding to specialize in cybersecurity. Through his work at Toronto Metropolitan University and post-graduation, he accumulated over five years of work experience in cybersecurity across financial institutions, startups, and consulting companies. His work was primarily focused on incident response, where he helped companies resolve security incidents and perform digital investigations.

  16. Page 16
    Read page 16 as text

    About the Technical Editor Mahalingam is an Azure Consultant and works with enterprises to design and implement their solutions in Azure. He also assesses large- scale applications hosted on Azure and provides recommendations to optimize them. He started his Azure journey five years ago and is a certified Azure Solutions Architect Expert, Azure Security Engineer Associate, and Azure Administrator Associate. In addition, he is a Microsoft Certified Trainer and delivers workshops on Azure IaaS and PaaS.

  17. Page 17
    Read page 17 as text

    Introduction The Microsoft Azure Platform is one of the most popular and diverse cloud-computing platforms in existence. It includes a wide range of security features designed to help clients protect their cloud environments. The Microsoft Azure Security Technologies exam, AZ- 500, focuses on testing a candidate's ability to be a subject matter expert on implementing Azure security controls. The exam focuses on four main areas: Managing identity and access Implementing platform protections Managing security operations Securing data and applications

  18. Page 18
    Read page 18 as text

    What Does This Book Cover? This book covers the topics outlined in the Microsoft Certified Associate Azure Security Engineer exam guide available at https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3VC70 Exam policies can change from time to time. We highly recommend that you check the Microsoft site for the most up-to- date information when you begin your preparing, when you register, and again a few days before your scheduled exam date. The book's outline is as follows: Chapter 1: Introduction to Microsoft Azure Chapter 1 outlines cloud computing best practices. The exam focuses on how to implement security controls that achieve specific goals in the Azure environment. In this chapter, you learn what these goals are for your cloud environment. Each of following chapters will correspond to one or more of these best practices. Before beginning this chapter you can may want to complete the assessment test to help you obtain a baseline of your current understanding of security and the Azure platform. Chapter 2: Managing Identity and Access on Microsoft Azure Chapter 2 focuses on how to implement good identity and access management practices on Azure. Topics include managing Azure Active Directory (AD) identities, securing access to resources and applications, and implementing role-based access control (RBAC). Chapter 3: Implementing Platform Protections Chapter 3 discusses how to implement good network security on the Azure platform. Topics include firewall configuration, endpoint protection, network monitoring, and how to use the Azure- specific security tools to accomplish these tasks. It begins with

  19. Page 19
    Read page 19 as text

    network security, exploring topics such as security groups; Windows Application Firewall (WAF); endpoint protection; DDoS protection; operational security, such as vulnerability management; disk encryption; and Secure Socket Layer/Transport Layer Security (SSL/TLS) certifications. Chapter 4: Managing Security Operations Chapter 4 focuses on how to use Azure tools like Azure Sentinel and Security Center to manage security operations. It includes discussions on creating custom alerts, policy management, vulnerability scans, and security configurations for the platforms. We then delve into how to configure good network monitoring using Azure Monitor, Azure Security Center, Azure Policy, Azure Blueprint, and Azure Sentinel. Chapter 5: Securing Data and Applications This chapter will focus on how to secure data and applications on the Azure platform. Topics include using secure data storage, creating data backups seamlessly, implementing database security, and leveraging Azure tools like Azure Defender and Key Vault. We also cover how to protect application backend databases by implementing database encryption, database authentication, and database auditing. Appendix A: Azure Security Tools Overview This appendix focuses on Microsoft Azure security tools that are used to create a secure platform. In this chapter, I review the tools' functions and how they can be used and integrated together to create security operations, compliance, networking monitoring, automated alerts, and proper logging. It also includes tools like Microsoft Azure Sentinel, Azure Key Vault, Azure Defender, Azure Firewall, Azure Policy, and Azure Monitor. Who Should Read This Book As the title implies, this book is intended for people who have an interest in understanding and implementing security features in Azure. These people probably fall into two basic groups:

  20. Page 20
    Read page 20 as text

    Security Professionals in an Azure Environment They can be IT administrators or security professionals who are responsible for securing their organization's Azure cloud environment. Candidates for the AZ-500 Exam This book is meant to be a study guide for anyone interested in taking the AZ-500 exam. It gives readers a clear understanding of the topics needed to pass the exam. It also comes with hundreds of practice questions/tests to help readers prepare for the type of questions they can expect on the exam. This book is designed for people who have some experience in cybersecurity. While we give a breakdown of all key foundational concepts relevant to the course, it's impossible to give readers all the information they would need in this book. For those of you with a cybersecurity/IT background, this will be no issue, but for the rest of you this might be a steep learning curve. So we encourage you to do your research if you ever need more context for the cybersecurity concepts found in this book. You can use this book in two ways. The most straightforward (and time consuming) is to start at the beginning and follow all the steps to gain a good overall understanding of security controls in Azure. Alternatively, you can skip around from chapter to chapter and only look at the areas of interest to you. For example, if you are having trouble understanding how to implement access management in your environment, then you may want to skip to Chapter 2 and just focus on that. Each chapter includes step-by-step instructions on how to implement the controls that we talk about in that chapter. Study Guide Features This study guide uses several common elements to help you prepare. These include the following: Summaries The summary section of each chapter briefly explains the chapter, allowing you to easily understand what it covers. Exam Essentials The exam essentials focus on major exam

  21. Page 21
    Read page 21 as text

    topics and critical knowledge that you should take into the test. The exam essentials focus on the exam objectives provided by Microsoft. Chapter Review Questions A set of questions at the end of each chapter will help you assess your knowledge and if you are ready to take the exam based on your knowledge of that chapter's topics. The review questions, assessment test, and other testing elements included in this book are not derived from the actual exam questions, so don't memorize the answers to these questions and assume that doing so will enable you to pass the exam. You should learn the underlying topic, as described in the text of the book. This will let you answer the questions provided with this book and pass the exam. Learning the underlying topic is also the approach that will serve you best in the workplace—the ultimate goal of a certification. Interactive Online Learning Environment and Test Bank Studying the material in the Microsoft Certified Associate Azure Security Engineer Study Guide is an important part of preparing for the Azure Security Engineer Associate certification exam, but we also provide additional tools to help you prepare. The online tools will help you understand the types of questions that will appear on the certification exam: The practice tests include all the questions in each chapter as well as the questions from the assessment test. In addition, there are two practice exams with 50 questions each. You can use these tests to evaluate your understanding and identify areas that may require additional study.

  22. Page 22
    Read page 22 as text

    The flashcards will push the limits of what you should know for the certification exam. There are 100 questions, which are provided in digital format. Each flashcard has one question and one correct answer. The online glossary is a searchable list of key terms introduced in this exam guide that you should know for the exam. To start using these tools to study for the exam, go to www.wiley.com/go/sybextestprep and register your book to receive your unique PIN. Once you have the PIN, return to www.wiley.com/go/sybextestprep , find your book, and click Register to register a new account or add this book to an existing account. Like all exams, the Microsoft Certified Associate Azure Security Engineer certification is updated periodically and may eventually be retired or replaced. At some point after Microsoft is no longer offering this exam, the old editions of our books and online tools will be retired. If you have purchased this book after the exam was retired, or you are attempting to register in the Sybex online learning environment after the exam was retired, please know that we make no guarantees that this exam's online Sybex tools will be available once the exam is no longer available. Additional Resources People learn in different ways. For some, a book is an ideal way to study whereas others may find practice test sites a more efficient way to study. Some of these websites come with exam pass guarantees and consistently update their content with some of the exact exam questions you will see on the official exam. These websites include www.udemy.com , www.exam-labs.com , https://acloudguru.com , and www.whizlabs.com . MCA Azure Security Engineer Study Guide

  23. Page 23
    Read page 23 as text

    Exam Objectives This table provides the extent, by percentage, each section is represented on the actual examination. Section % of Examination Section 1: Manage Identity and Access 30–35% Section 2: Implement Platform Protection 15–20% Section 3: Manage Security Operations 25–30% Section 4: Secure Data and Applications 25–30% Exam objectives are subject to change at any time without prior notice and at Microsoft's sole discretion. Please visit the Exam AZ-500: Microsoft Azure Security Technologies website ( https://docs.microsoft.com/en-us/certifications/exams/az-500 ) for the most current listing of exam objectives. Objective Map The following objective map will allow you to find the chapter in this book that covers each objective for the exam. Objective Chapter Section 1: Manage Identity and Access 2 1.1 Manage Azure Directory (Azure AD) Identities 2 1.2 Manage secure access by using Azure AD 2 1.3 Manage Application Access 2 1.4 Manage Access Control 2 Section 2: Implement Platform Protection 3 2.1 Implement advanced network security 3 2.2 Configure advanced security for compute 3

  24. Page 24
    Read page 24 as text

    Section 3: Manage security operations 4 3.1 Configure centralized policy management 4 3.2 Configure and manage threat protection 4 3.3 Configure and manage security monitoring solutions 4 Section 4: Secure data and applications 5 4.1 Configure security for storage 5 4.2 Configure security for data 5 4.3 Configure and manage Azure Key Vault 5 How to Contact Wiley or the Author If you believe you have found a mistake in this book, please bring it to our attention. At John Wiley & Sons, we understand how important it is to provide our customers with accurate content, but even with our best efforts an error may occur. In order to submit your possible errata, please email it to our Customer Service Team at wileysupport@wiley.com with the subject line “Possible Book Errata Submission.” Assessment Test 1. What is Azure AD? A. It's a cloud version of Windows Active Directory (AD). B. It is a cloud-based identity management service. C. It is used for enabling multifactor authentication (MFA). D. It protects accounts from authentication-based attacks. 2. What is a managed identity? A. A shared user account B. A user account managed by another user C. An identity that your Azure services can use for

  25. Page 25
    Read page 25 as text

    authentication D. A tool for controlling access to a user account 3. What is Privileged Identity Management (PIM)? A. Protection for highly valuable Azure resources B. Protection of your organization's most privileged accounts C. Protection for admin-level Azure accounts D. A type of role-based access control (RBAC) 4. What is role-based access control (RBAC)? A. Assigning individual permissions based on a user's jobs B. Controlling assess based solely on an individual's job titles C. An Azure tool for controlling access to resources in Azure D. A method where you assign permissions to a job role/identity as needed, rather than assigning permissions to an individual 5. What is not a feature of Azure Firewall Manager? A. DDoS protection B. Azure Firewall deployment and configuration C. Creation of global and local firewall policies D. Integration with third-party security features 6. What is the function of an Azure Application Gateway? A. It's a tool for building and operating scalable applications. B. It's an application load balancer. C. It filters web traffic to applications. D. It's Azure's native web application firewall. 7. What is the function of Azure Front Door? A. DDoS protection B. Protection against web-based attacks on applications

  26. Page 26
    Read page 26 as text

    C. Filtering of web application attacks D. Launching and operating of scalable applications 8. Where can you configure basic Azure DDoS Protection? A. The Azure portal B. Under Target Resources settings C. It doesn't require configuration. D. The Azure command line 9. What is the purpose of an Azure policy? A. To enforce the standards of your organization and ensure compliance of your Azure resources B. To set parameters on what resources can be created C. To set parameters on who can access the resources D. To act as a documentation tool 10. What is not a feature of Microsoft Defender for Cloud? A. Real-time protection B. Automatic and manual scanning C. Detection and remediation D. Capture of logs 11. What is the purpose of threat modeling? A. Identifying threats currently on your network B. Mapping out potential threats and their mitigation C. Identifying vulnerabilities in upcoming applications D. Mapping out the secure architecture of a software product 12. What is the function of Microsoft Sentinel? A. It provides logging and monitoring for your Azure environment. B. It is an endpoint security tool for protecting network

  27. Page 27
    Read page 27 as text

    resources. C. It is the cloud-native security information and event management (SIEM) and security orchestration, automation, and response (SOAR) platform that performs threat detection and analytics. D. It allows you to manage Azure firewalls from a central location. 13. What is the purpose of an Azure storage account? A. It contains a list of usernames and passwords for authentication. B. It's a container for grouping databases. C. It's a type of user account. D. It stores data. 14. What is the function of Azure Cosmos Database (DB)? A. To store secrets in Azure B. To acts as a fully managed NoSQL database designed for modern application development C. To manage databases D. To manage virtual endpoints 15. What is Azure Key Vault used for? A. It's a cloud service for securely storing and accessing secrets. B. It's a cloud password manager. C. It provides physical protection for Azure servers. D. It stores data objects in Azure. 16. What is a threat vector? A. A nation-state threat actor B. A group or individual with malicious intent C. A type of malware

  28. Page 28
    Read page 28 as text

    D. A path or means for exploiting a vulnerability 17. Which of the following is a type of administrative security control? A. The separation of duties B. Security guards C. Security group policies D. Computer logging 18. Which of the following is a NoSQL store for structured data? A. Azure files B. Azure blobs C. Azure tables D. Azure disks 19. What are threat actors? A. A type of hacker group B. A group or individual with malicious intent C. A group with knowledge of company vulnerabilities D. Insider threats 20. What tool is best used for threat hunting? A. Microsoft's Threat Modeling Tool B. Azure Storage C. Microsoft Sentinel D. Azure Active Directory (AD) Answers to Assessment Test 1. B. Azure AD allows employees (or anyone on an on-premises network) to access external resources with proper authentication.

  29. Page 29
    Read page 29 as text

    2. C. Managed identities allow your Azure Services to authenticate. 3. B. Azure PIM has special features for managing, controlling, and monitoring access to your organization's most privileged accounts. 4. D. In RBAC, you assign permissions to a job role/identity, and then assign that role/identity to users as needed. 5. A. Azure has a dedicated tool for DDoS protection. 6. B. Azure Application Gateway is an application load balancer for managing traffic to backend resources. 7. D. Azure Front Door is a tool for launching web applications. 8. C. Azure DDoS protection is enabled by default. 9. A. An Azure policy allows you check whether resources meet the standards you set and to correct those resources automatically. 10. D. Microsoft Defender for Cloud does log analytics but it doesn't capture logs. 11. B. Threat modeling is the process of identifying potential threats and mitigation of such threats. 12. C. Microsoft Sentinel provides SIEM and SOAR functionality in Azure. 13. D. Storage accounts contain all the different types of data objects in Azure. 14. B. Azure Cosmos DB is a service for creating NoSQL databases for application development. 15. A. Azure Key Vault is a service for securely storing secrets in Azure. 16. D. A threat vector is the path or means that a threat actor takes for exploiting a vulnerability. 17. A. The separation of duties is an admin security control where a company requires more than one person to complete a given task in order to prevent fraud.

  30. Page 30
    Read page 30 as text

    18. C. Azure tables are a NoSQL store for the storage of structured data. 19. B. Threat actors are any group with a malicious intent that hacks into a company. 20. C. Microsoft Sentinel is Azure's premier threat-hunting solution as well as a SOAR and SIEM platform.

  31. Page 31
    Read page 31 as text

    Chapter 1 Introduction to Microsoft Azure THE MCA MICROSOFT CERTIFIED ASSOCIATE AZURE SECURITY ENGINEER ASSESSMENT TEST TOPICS COVERED IN THIS CHAPTER INCLUDE: What Is Microsoft Azure? Cloud Environment Security Objectives Confidentiality Integrity Availability Nonrepudiation Common Security Issues Principle of Least Privilege Zero-Trust Model Defense in Depth Avoid Security through Obscurity The AAAs of Access Management Encryption End-to-End Encryption Symmetric Key Encryption Asymmetric Key Encryption Network Segmentation Basic Network Configuration Unsegmented Network Example

458 more pages in the full document

Unlock it once and it stays in your library, ready to chat with or turn into flashcards.

Unlock the full document

More Azure Networking Practice Exam study materials

See all

Study this document with CramX

Once it is in your library, every tool can work from it.