Complete Exam Notes
Study Reference

What: Users/devices can be automatically added to a group based on attribute-based rules (e.g., department = "Engineering", jobTitle = "Developer").

How: Rules are configured the same way for both Security Groups and M365 Groups. When a user attribute matches the rule, they are automatically added/removed.

License needed: Entra ID P1 or P2

Problem solved: Traditionally, apps needing to access Azure resources (like Key Vault) needed credentials embedded in code — a security risk.

Managed Identity: Azure manages the identity automatically. No credentials in code. The resource gets an SP in Entra ID, and you assign RBAC to that SP.

MFA adds an extra layer of authentication beyond username/password. Even if credentials are compromised, attacker still cannot authenticate without the second factor.

Security Defaults: Free tier feature that enables baseline MFA for all users. Replaces the old baseline Conditional Access policies.

Conditional Access is if-then policies: IF a user/condition is detected, THEN enforce a control. Think of it as the zero-trust policy engine for access decisions.

Detects inconsistencies and anomalies in the sign-in process using machine learning. Generates risk signals that can be used in Conditional Access policies.

PIM manages users with privileged roles. Instead of permanent role assignments, users get eligible assignments and must activate the role on demand.

Purpose: Provides remote access to on-premises web applications without opening inbound firewall ports. Users access on-prem apps through Entra ID from anywhere on the internet.

An isolated network on the Azure cloud. Resources hosted in a VNet communicate privately. Scoped to a specific region and subscription.

NSGs filter network traffic between Azure resources in a VNet. They contain Inbound and Outbound security rules.

ASGs are an extension to NSGs that allow you to group VMs together logically and use those groups as source/destination in NSG rules. Instead of managing IP addresses, you manage app-layer groups.

Connects two VNets together so resources can communicate directly using Microsoft backbone network (low latency, high bandwidth). Works same region and cross-region.

Extends on-premises network to Microsoft cloud via a private, dedicated connection — NOT over the internet. Provided through a connectivity partner.

Centralized networking service to connect all network entities (VNets, on-premises branches, users) through a managed hub-and-spoke architecture.

Fully managed NoSQL, relational, and vector database service. Provides fast, globally distributed data access.

Fully managed platform for hosting web apps. Infrastructure (VM, OS, patching) is managed by Azure. High availability built-in.

A Layer 7 (HTTP/HTTPS) load balancer that routes traffic based on HTTP request attributes (URL path, hostname, headers). Deployed in a dedicated empty subnet.

Can be enabled on Application Gateway to protect against common web attacks like SQL Injection (SQLi) and Cross-Site Scripting (XSS). Uses OWASP rule sets.

A fully managed, cloud-native, stateful network security appliance. Unlike NSGs (which filter within VNets), Azure Firewall provides full network/application-level inspection and can look into requests from external users or internal users trying to reach the internet.

Creating a firewall alone doesn't route traffic through it. You must:

1. Create the Azure Firewall in a hub VNet (needs AzureFirewallSubnet)
2. Create a Route Table with a route: 0.0.0.0/0 → Azure Firewall private IP
3. Associate the Route Table with the spoke subnets (e.g., WebSubnet)
4. Create Firewall application/network rules to allow needed traffic

Fully managed service providing secure RDP/SSH connections to VMs from the Azure Portal — no public IP needed on the VM. Eliminates exposure of RDP/SSH ports to the internet.

Hub contains shared services: Azure Firewall, VPN/ExpressRoute Gateway, Azure Bastion, DNS. Spokes contain workloads and connect to Hub via VNet Peering. All traffic between spokes or to internet is routed through Hub Firewall via UDRs.

Azure SQL Managed Instance has native virtual network implementation. It is deployed inside a VNet, providing full VNet integration unlike Azure SQL Database (which is a public service by default).

Managed service for storing secrets (connection strings, passwords), encryption keys, and certificates (HTTPS). Used to keep sensitive data out of code and config files.

Secrets, keys, and certificates can be backed up to an encrypted backup file and restored at any time. The backup is encrypted and can only be restored to the same Azure geography.

Azure Key Vault supports automatic key rotation. You can configure a rotation policy to automatically rotate keys on a schedule. Integrates with services like Azure Storage for auto-rotating encryption keys.

Encrypts Windows VM disks using BitLocker and Linux VM disks using DM-Crypt. Keys stored in Azure Key Vault. Protects data if physical disks are removed from datacenter.

By default, Azure uses Microsoft-managed keys for encryption. With CMK, you bring your own keys stored in Azure Key Vault. You control the key lifecycle (rotation, revocation). If you revoke the key, data becomes inaccessible — giving you full control.

Helps govern Azure resources by defining rules (policies) that resources must comply with. Can enforce at subscription or management group level.

Initiative: A collection of policies grouped together (e.g., ISO 27001 initiative = 100+ policies).

For existing non-compliant resources: Remediation Tasks can be created to bring resources into compliance. Example: if "enable diagnostic settings" policy is added, remediation can automatically enable it on existing resources.

Governance service that packages policies, RBAC assignments, ARM templates, and resource groups into a versioned, reusable blueprint. Applied across subscriptions to ensure consistent, compliant environments.

Central platform for collecting, analyzing, and acting on telemetry from Azure and on-premises resources.

Central repository for log data. Data is stored in tables with rows and columns. Multiple resources (VMs, services) can send data to a single workspace. Queried using Kusto Query Language (KQL).

Cloud-native SIEM (Security Information and Event Management) + SOAR (Security Orchestration, Automation and Response). Sits on top of a Log Analytics workspace and provides threat detection, investigation, and response capabilities.

Cloud Security Posture Management (CSPM) + Cloud Workload Protection Platform (CWPP). Protects workloads across Azure, AWS, GCP, and on-premises.

Numeric score (0–100%) representing your overall security posture. Based on security controls — each control has a max score. Remediating recommendations increases your score. Higher score = better security posture.

Part of Defender for Servers. Locks down inbound ports (RDP 3389, SSH 22) on a VM by default. When access is needed, a request is made and access is granted for a limited time, then automatically revoked. Reduces attack surface.

ML-powered feature in Defender for Servers. Analyzes what applications run on your VMs and creates an allowlist of known-good applications. Alerts when unexpected applications run (potential malware or unauthorized software).

Workflow Automation: Trigger Logic Apps in response to Defender for Cloud alerts or recommendation state changes. Used to auto-remediate or notify teams.

Security Recommendations: Actionable suggestions to improve security posture. Each recommendation shows affected resources, severity, and remediation steps.

Instead of SQL logins, use Entra ID users/groups for database access. Set an Entra Admin for the SQL Server. Users can then connect using their Entra credentials (SSO, MFA, conditional access apply).

Tracks database events and writes an audit log. Used for regulatory compliance and security investigation.

Hides sensitive data (e.g., credit cards, emails) from non-privileged users at query time. Data remains stored unmasked in the database. Only the query results are masked for non-privileged users.

Encrypts database files, backups, and transaction logs at rest on physical discs. Encryption/decryption happens in real-time, transparent to the application. Already enabled by default on Azure SQL Database.

Protects sensitive column data (credit cards, SSNs) even from DBAs. Data is encrypted client-side before being sent to the database. The database engine never sees plaintext.

Azure SQL Database has server-level and database-level firewall rules. By default, all external access is blocked. You must explicitly allow client IP ranges or Azure services.

A SAS is a signed URI that grants time-limited, granular access to storage resources without sharing account keys. Fine-grained permissions (read, write, delete, list) on specific resources.

Containers package application code + dependencies into a portable, isolated unit. Lighter than VMs (share OS kernel). Docker is the standard container runtime.

A private container registry (like a private Docker Hub) for storing Docker container images. Supports geo-replication for multi-region deployments.

Run containers directly in Azure without managing VMs or orchestrators. Serverless containers. Good for simple tasks, batch jobs, and burst workloads. No cluster management needed.

Managed Kubernetes service. Azure manages the control plane. You manage worker nodes (or use nodepools). Supports auto-scaling, rolling deployments, and advanced networking.

• NSG priority: Lower number = Higher priority. 100 beats 4096. Once a rule matches, processing STOPS.
• NSG association: Can ONLY attach to Subnet or NIC — NOT to an entire VNet.
• VNet Peering: No overlapping CIDR blocks allowed.
• Service Endpoint: Does NOT block internet traffic to the service — use Private Endpoint for that.
• Private Endpoint: Creates NIC in your VNet. Traffic NEVER leaves your VNet. Chargeable per hour.
• PIM max activation: 8 hours maximum per role activation.
• M365 Groups: Cannot be added to a Security Group.
• Blueprint locks: Even subscription owners cannot delete locked resources — must unassign blueprint first.
• TDE: Already enabled by default on Azure SQL Database.
• Dynamic Data Masking: Does NOT encrypt — masks at query result level only.
• Always Encrypted: Must use SSMS to configure — not Azure portal.
• Firewall rule order: DNAT → Network → Application rules (always in this order).
• Azure Bastion subnet: Must be named exactly AzureBastionSubnet.
• Synced users: Properties of on-prem synced users CANNOT be changed in Entra ID.
• AcrPull/AcrPush: Reader role ≠ image pull. Contributor ≠ data plane access.
• Security Defaults vs Conditional Access: Mutually exclusive — disable one to use the other.
• Purge Protection: When enabled, even admins cannot permanently delete until retention period expires.
• Soft Delete retention: 7–90 days (configurable).