Luyện thi Azure Security Engineer AZ-500

Microsoft Entra ID provides identity and access management. Firewalls, storage, and DNS are different services.

MFA requires multiple verification factors such as password and phone. One password, disabled logins, and storage are different.

Conditional Access evaluates user, device, location, and risk signals. Firewall rules, storage policies, and DNS are different.

RBAC grants permissions through roles. Networks, databases, and CDNs are different.

Managed identities give Azure resources an identity without managing credentials. User accounts, DNS, and firewalls are different.

Service principals represent applications. VMs, storage accounts, and NSGs are resources.

Custom roles define specific permissions. Built-in roles, DNS records, and firewall rules are different.

PIM provides just-in-time privileged access. Firewalls, storage, and load balancers are different.

Guest users are external collaborators. Administrators, VMs, and service principals are different.

Entra ID is the identity service, MFA adds factors, Conditional Access evaluates policies, and RBAC grants role permissions.

Defender for Cloud improves posture and protects workloads. DNS, storage, and CDN are different.

Azure Firewall filters network traffic. Databases, DNS zones, and load balancers are different.

DDoS Protection mitigates volumetric attacks. Backups, DNS, and alarms are different.

WAF protects web applications from common attacks. VMs, storage, and databases are resources.

Security baselines define recommended settings. Firewall rules, DNS records, and containers are different.

Secure score measures how well an environment follows security recommendations. Routes, databases, and backups are different.

JIT access opens ports only when needed. Always-open ports, disabled VMs, and DNS are different.

Adaptive application control builds application allowlists. Firewalls, DNS, and load balancers are different.

Vulnerability assessments find weaknesses. Storage, DNS, and load balancing are different.

Defender manages posture, Firewall filters traffic, DDoS Protection defends against attacks, and WAF protects web apps.

Key Vault stores secrets, keys, and certificates. Databases, DNS, and CDNs are different.

Secrets are sensitive strings like passwords. Models, firewall rules, and routes are different.

TDE encrypts database files at rest. Network encryption, backups, and filtering are different.

Encryption at rest protects stored data. Transit encryption, DNS, and firewalls are different.

Transit encryption protects moving data, usually with TLS. At-rest encryption, backups, and filters are different.

Certificates support TLS and authentication. Files, traffic filters, and reports are different.

Customer-managed keys are controlled by the customer. Microsoft-managed keys, DNS, and firewall rules are different.

Data masking hides sensitive values in results. Encryption, deletion, and backups are different.

Defender for Storage detects threats in storage accounts. DNS, load balancers, and backups are different.

Key Vault stores secrets, secrets are sensitive values, TDE encrypts databases, and customer-managed keys are owned by you.

NSGs filter traffic with allow and deny rules. Databases, DNS zones, and load balancers are different.

Private endpoints give services private IP addresses in a VNet. Public sites, DNS, and firewalls are different.

VPN Gateway sends encrypted traffic over the internet. Databases, storage, and CDNs are different.

ExpressRoute provides private connectivity to Azure. Public internet, DNS records, and load balancers are different.

Segmentation isolates workloads to limit blast radius. Merging, deleting firewalls, and DNS are different.

Service tags represent Azure service IP ranges. VM names, databases, and storage accounts are different.

ASGs group VMs by application. DNS records, firewalls, and load balancers are different.

Bastion provides secure remote access without exposing public IPs. Websites, databases, and storage are different.

Private DNS zones resolve names inside a VNet. Public records, firewalls, and load balancers are different.

NSGs filter traffic, private endpoints provide private access, VPN Gateway tunnels traffic, and Bastion enables secure remote access.

Sentinel provides security information and event management plus orchestration. DNS, storage, and CDN are different.

Detection rules generate alerts from analytics. Firewall rules, DNS records, and load balancers are different.

Incidents group related alerts for investigation. Logs, VMs, and storage accounts are different.

Automation rules run response actions on incidents. Firewalls, DNS, and load balancers are different.

Workbooks display interactive charts and dashboards. Databases, firewalls, and DNS zones are different.

Data connectors bring logs into Sentinel. Cables, storage accounts, and DNS records are different.

Playbooks automate responses with Logic Apps. Reports, dashboards, and firewalls are different.

Azure Monitor collects monitoring data. DNS, CDN, and storage are different.

KQL queries log data in Azure Monitor and Sentinel. Frameworks, firewalls, and DNS protocols are different.

Sentinel is SIEM/SOAR, detection rules trigger alerts, playbooks automate responses, and workbooks visualize data.

Azure Policy enforces organizational rules. Databases, DNS, and load balancers are different.

Initiatives group policies for a common goal. Single policies, storage accounts, and DNS zones are different.

Blueprints package policies, roles, and resources. Firewalls, databases, and CDNs are different.

Compliance standards are frameworks like ISO or NIST. Firewall rules, DNS records, and containers are different.

Purview provides data governance and compliance. DNS, load balancers, and CDNs are different.

Tags organize resources and support cost tracking. Firewall rules, DNS records, and databases are different.

Management groups create a hierarchy for policy and governance. VMs, storage, and DNS zones are resources.

Audit policies monitor and log noncompliance. Deny policies block resources, and firewalls or load balancers are different.

Deny policies prevent noncompliant resources. Logging-only policies, DNS records, and containers are different.

Azure Policy enforces rules, initiatives group policies, Blueprints package governance, and Purview governs data.