AZ-500 Study Guide: Microsoft Azure Security Technologies 2021

The content of the AZ-500 Microsoft Azure Security Technologies exam was just updated in January 2021. That is why I want to share my new updated AZ-500: Microsoft Azure Security Technologies Certification Exam Study Guide for 2021 with you.  If you are passing the AZ-500 exam, you will earn the Microsoft Certified: Azure Security Engineer Associate certification, that you understand how to implement security controls and threat protection; manage identity and access; and protect data, applications, and networks in cloud and hybrid environments as part of end-to-end infrastructure.

To learn and prepare for the exam, I usually use a couple of online resources, mainly Microsoft Docs and Microsoft Learn, which I am going to share with you. You can find more information about how I prepare for a Microsoft Certification exam on my blog post: How to prepare and pass Microsoft Certification Exam.

Also, check out other Microsoft Azure Certification Exam Study Guides:

• Exam AZ-900: Microsoft Azure Fundamentals Exam Study Guide
• Exam AZ-104: Microsoft Azure Administrator Exam Study Guide
• Exam AZ-204: Developing Solutions for Microsoft Azure Exam Study Guide
• Exam AZ-303: Microsoft Azure Architect Technologies Exam Study Guide
• Exam AZ-304: Microsoft Azure Architect Design Certification Exam Study Guide
• Exam AZ-305: Microsoft Azure Solutions Architect Certification Exam Study Guide
• Exam AZ-600: Configuring and Operating a Hybrid Cloud with Microsoft Azure Stack Hub Exam Study Guide
• Exam AZ-700: Microsoft Azure Network Engineer Exam Study Guide
• Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals Exam Study Guide
• Exam DP-300: Azure Database Administrator Exam Study Guide

Here is my AZ-500 Microsoft Azure Security Technologies

It is essential to get familiar with the exam objectives and skills measured first. That is why I recommend reading the description of the exam and the skills measured.

Exam AZ-500: Microsoft Azure Security Technologies

Candidates for this exam should have subject matter expertise implementing security controls and threat protection, managing identity and access, and protecting data, applications, and networks in cloud and hybrid environments as part of an end-to-end infrastructure.

Responsibilities for an Azure Security Engineer include maintaining the security posture, identifying and remediating vulnerabilities by using a variety of security tools, implementing threat protection, and responding to security incident escalations.

Azure Security Engineers often serve as part of a larger team dedicated to cloud-based management and security or hybrid environments as part of an end-to-end infrastructure.

A candidate for this exam should be familiar with scripting and automation, should have a deep understanding of networking and virtualization. A candidate should also have a strong familiarity with cloud capabilities, Azure products and services, and other Microsoft products and services.

The high-level view of the skills measured in the exam:

• Manage identity and access (30-35%)
• Implement platform protection (15-20%)
• Manage security operations (25-30%)
• Secure data and applications (20-25%)

You can find more information on the exam website.

Free Online Microsoft Learn AZ-500 Exam Study Guide resources

Microsoft Learn provides you with free online training and learning paths for different Microsoft technologies. They not just offer reading material, but also control questions and free online labs. Here are some relevant Microsoft Learn modules and learning paths for the AZ-500 Microsoft Azure Security Technologies Certification Exam. Microsoft Learn is an important part of my AZ-500 exam study guide.

• Secure your cloud applications in Azure (6 modules)
• Implement resource management security in Azure (6 modules)
• Implement network security in Azure (5 modules)
• Implement virtual machine host security in Azure (6 modules)
• Manage identity and access in Azure Active Directory (9 modules)
• Manage security operations in Azure (8 modules)

Microsoft Docs AZ-500 study guide resources

One thing I always used to prepare for my Microsoft exams is Microsoft Docs. Here are the relevant Microsoft Docs which I used to prepare and study for the AZ-500 exam.

Manage Identity and Access (30-35%)

Manage Azure Active Directory identities

• configure security for service principals
  • Application and service principal objects in Azure Active Directory
• manage Azure AD directory groups
  • Manage app and resource access using Azure Active Directory groups
  • Create a basic group and add members using Azure Active Directory
• manage Azure AD users
  • Add or delete users using Azure Active Directory
  • Assign or remove licenses in the Azure Active Directory portal
• configure password writeback
  • Tutorial: Enable Azure Active Directory self-service password reset writeback to an on-premises environment
• configure authentication methods including password hash and Pass Through
  Authentication (PTA), OAuth, and passwordless
  • What authentication and verification methods are available in Azure Active Directory?
• transfer Azure subscriptions between Azure AD tenants
  • Associate or add an Azure subscription to your Azure Active Directory tenant
  • Transfer billing ownership of an Azure subscription to another account
  • Transfer Azure subscriptions between subscribers and CSPs
• implement Conditional Access policies
  • What is Conditional Access?
  • Plan a Conditional Access deployment
  • Best practices for Conditional Access in Azure Active Directory

Configure secure access by using Azure AD

• monitor privileged access for Azure AD Privileged Identity Management (PIM)
  • What is Azure AD Privileged Identity Management?
  • Assign Azure AD roles in Privileged Identity Management
  • Deploy Azure AD Privileged Identity Management (PIM)
• configure Access Reviews
  • Use a resource dashboard to perform an access review in Privileged Identity Management
  • Review access to Azure AD roles in Privileged Identity Management
  • Create an access review of Azure AD roles in Privileged Identity Management
• activate and configure PIM Privileged Identity Management
  • Activate my Azure AD roles in PIM
• implement Conditional Access policies including Multi-Factor Authentication (MFA)
  • Configure Azure Multi-Factor Authentication settings
  • Manage user settings for Azure Multi-Factor Authentication
  • Change your two-factor verification method and settings
• configure Azure AD identity protection
  • What is Azure Active Directory Identity Protection?
  • How To: Configure the Azure Multi-Factor Authentication registration policy

Manage application access

• create App Registration
  • How to: Use the portal to create an Azure AD application and service principal that can access resources
  • Quickstart: Register an application with the Microsoft identity platform
• configure App Registration permission scopes
  • Permissions and consent in the Microsoft identity platform endpoint
• manage App Registration permission consent
  • Permissions and consent in the Microsoft identity platform endpoint
• manage API access to Azure subscriptions and resources
  • Authentication flows and application scenarios
  • Add or remove Azure role assignments using the REST API

Manage access control

• configure subscription and resource permissions
  • What is Azure role-based access control (Azure RBAC)? 
  • Tutorial: Grant a user access to Azure resources using the Azure portal
• configure resource group permissions
  • Manage Azure Resource Manager resource groups by using the Azure portal
• configure custom RBAC roles
  • Azure custom roles
• identify the appropriate role
  • Azure Identity Management and access control security best practices
  • List Azure role definitions
• apply principle of least privilege
  • Azure Identity Management and access control security best practices
• interpret permissions
  • List Azure role assignments using the Azure portal
• check access
  • Quickstart: Check access for a user to Azure resources

Implement Platform Protection (15-20%)

Implement advanced network security

• secure the connectivity of virtual networks (VPN authentication, Express Route
  encryption)
  • What is VPN Gateway?
  • Configure Azure Active Directory authentication for User VPN
  • What is Azure ExpressRoute?
  • ExpressRoute encryption
• configure Network Security Groups (NSGs) and Application Security Groups (ASGs)
  • Create, change, or delete a network security group
  • Application security groups
• create and configure Azure Firewall
  • What is Azure Firewall?
  • Tutorial: Deploy and configure Azure Firewall using the Azure portal
• implement Azure Firewall Manager
  • What is Azure Firewall Manager?
  • Tutorial: Secure your virtual hub using Azure Firewall Manager
• create and configure Azure Front Door service as an Application Gateway
  • What is Azure Front Door?
  • Quickstart: Create a Front Door for a highly available global web application
• configure a Web Application Firewall (WAF) on Azure Application Gateway
  • What is Azure Web Application Firewall on Azure Application Gateway?
• configure Azure Bastion
  • What is Azure Bastion? 
  • Security management in Azure
• configure a firewall on a storage account, Azure SQL, KeyVault, or App Service
  • Configure Azure Storage firewalls and virtual networks
  • Configure Azure Firewall application rules with SQL FQDNs
  • Configure Azure Key Vault firewalls and virtual networks
  • Set up Azure App Service access restrictions
  • Locking down an App Service Environment
• implement Service Endpoints
  • Virtual Network service endpoints
• implement DDoS protection
  • Azure DDoS Protection Standard overview

Configure advanced security for compute

• configure endpoint protection
  • Microsoft Antimalware for Azure Cloud Services and Virtual Machines
  • Azure Virtual Machines security overview
• configure and monitor system updates for VMs
  • Update Management overview
  • Manage updates and patches for your Azure VMs
• configure authentication for Azure Container Registry
  • Authenticate with an Azure container registry
  • Use an Azure managed identity to authenticate to an Azure container registry
• configure security for different types of containers
  • Container security in Security Center
  • Security considerations for Azure Container Instances
  • Security concepts for applications and clusters in Azure Kubernetes Service (AKS)
• implement vulnerability management
  • Security Control: Vulnerability Management
• configure isolation for AKS
  • Secure traffic between pods using network policies in Azure Kubernetes Service (AKS)
• configure security for container registry
  • Monitoring the security of your containers
• implement Azure Disk Encryption
  • Azure Disk Encryption for virtual machines and virtual machine scale sets
• configure authentication and security for Azure App Service
  • Azure security baseline for App Service
  • Authentication and authorization in Azure App Service and Azure Functions
• configure SSL/TLS certs
  • Use a TLS/SSL certificate in your code in Azure App Service
• configure authentication for Azure Kubernetes Service
  • Use managed identities in Azure Kubernetes Service
  • Service principals with Azure Kubernetes Service (AKS)
• configure automatic updates
  • Security concepts for applications and clusters in Azure Kubernetes Service (AKS)
  • Preview – Secure your cluster using pod security policies in Azure Kubernetes Service (AKS)
  • Security hardening for AKS agent node host OS

Manage Security Operations (25-30%)

Monitor security by using Azure Monitor

• create and customize alerts
  • Azure security baseline for Azure Monitor
  • Respond to events with Azure Monitor Alerts
  • Manage and respond to security alerts in Azure Security Center
  • Security alerts in Azure Security Center
• monitor security logs by using Azure Monitor
  • Azure Monitor Logs overview
  • Azure security logging and auditing
• configure diagnostic logging and log retention
  • Azure diagnostic logs
  • Create diagnostic setting to collect resource logs and metrics in Azure
  • Overview of log queries in Azure Monitor
  • Overview of Azure platform logs

Monitor security by using Azure Security Center

• evaluate vulnerability scans from Azure Security Center
  • Integrated vulnerability scanner for virtual machines (Standard tier only)
  • Vulnerability assessments for your Azure Virtual Machines
• configure Just in Time VM access by using Azure Security Center
  • Secure your management ports with just-in-time access
  • Azure – Just in Time VM access
• configure centralized policy management by using Azure Security Center
  • Centralized Policy Management in Azure Security Center using Management Groups
  • Working with security policies
  • Azure security policies monitored by Security Center
• configure compliance policies and evaluate for compliance by using Azure Security
  Center
  • Customizing the set of standards in your regulatory compliance dashboard

Monitor security by using Azure Sentinel

• create and customize alerts
  • Tutorial: Detect threats out-of-the-box
  • What is Azure Sentinel? 
  • Tutorial: Set up automated threat responses in Azure Sentinel
• configure data sources to Azure Sentinel
  • Connect data sources
• evaluate results from Azure Sentinel
  • Tutorial: Visualize and monitor your data
  • Tutorial: Investigate incidents with Azure Sentinel
• configure workflow automation by using Azure Sentinel
  • Azure security baseline for Azure Sentinel
  • Tutorial: Set up automated threat responses in Azure Sentinel

Configure security policies

• configure security settings by using Azure Policy
  • What is Azure Policy?
  • Quickstart: Create a policy assignment to identify non-compliant resources
• configure security settings by using Azure Blueprint
  • Security compliance with Azure Policy and Azure Blueprints
• configure a playbook by using Azure Sentinel
  • Tutorial: Set up automated threat responses in Azure Sentinel

Secure Data and Applications (20-25%)

Configure security for storage

• configure access control for storage accounts
  • Authorizing access to data in Azure Storage
  • Authorize access to blobs and queues using Azure Active Directory
• configure key management for storage accounts
  • Manage storage account access keys
• configure Azure AD authentication for Azure Storage
  • Authorize access to blobs and queues using Azure Active Directory
• configure Azure AD Domain Services authentication for Azure Files
  • Enable Azure Active Directory Domain Services authentication on Azure Files
• create and manage Shared Access Signatures (SAS)
  • Grant limited access to Azure Storage resources using shared access signatures (SAS)
  • Control access to Azure Storage with shared access signatures
• create a shared access policy for a blob or blob container
  • Define a stored access policy
• implement Storage Service Encryption
  • Azure Storage encryption for data at rest
  • Storage, data, and encryption

Configure security for databases

• enable database authentication
  • Tutorial: Secure Azure SQL Database connection from App Service using a managed identity
  • Configure and manage Azure Active Directory authentication with SQL
  • Use Azure Active Directory Authentication for authentication with SQL
• enable database auditing
  • Azure SQL Auditing for Azure SQL Database and Azure Synapse Analytics
• configure Azure SQL Database Advanced Threat Protection
  • Advanced Threat Protection for Azure SQL Database
  • Azure SQL Database Advanced Threat Protection for single or pooled databases
• implement database encryption
  • Transparent data encryption for SQL Database and Azure Synapse
  • An overview of Azure SQL Database security capabilities
  • Azure encryption overview
  • An overview of Azure SQL Database security capabilities
• implement Azure SQL Database Always Encrypted
  • Always Encrypted
  • Always Encrypted: Protect sensitive data and store encryption keys in Azure Key Vault

Configure and manage Key Vault

• manage access to Key Vault
  • About Azure Key Vault
  • Secure access to a key vault
  • Provide Key Vault authentication with a managed identity
  • Provide Key Vault authentication with an access control policy
• manage permissions to secrets, certificates, and keys
  • About keys, secrets, and certificates
• configure RBAC usage in Azure Key Vault
  • Secure access to a key vault
• manage certificates
  • Get started with Key Vault certificates
• manage secrets
  • Manage secrets in your server apps with Azure Key Vault
  • Configure and manage secrets in Azure Key Vault
• configure key rotation
  • Set up Azure Key Vault with key rotation and auditing
  • Tutorial: Configure certificate auto-rotation in Key Vault
• backup and restore of Key Vault items
  • Azure Key Vault backup

AZ-500 Study Guide Microsoft Azure Security Technologies Additional Tips and Resources

I hope this AZ-500 Microsoft Azure Security Technologies Certification Exam Study Guide helps you pass the exam and get the Microsoft Certified: Azure Security Engineer Associate certification. I also recommend that you open a free Azure account if you don’t have one yet. You can create your free Azure account here. Also, check out my blog posts about Microsoft Azure Certification:

• Why you should become Microsoft Azure certified
• How to pick the right Azure exam certification path
• How to prepare and pass a Microsoft Azure exam
• Learn Microsoft Azure in 2020

I hope you enjoyed my AZ-500 Microsoft Azure Security Technologies Study Guide. Did I miss any link, or do you have any recommended AZ-500 Microsoft Azure Security Technologies Certification Exam Study resources? Let me know in the comments.