AZ-500 · Domain 3
Secure Compute, Storage and Databases
About 25% of the exam
Compute hardening
- Just in time access
- opens management ports briefly
- Update management
- patch compliance across machines
- Endpoint protection
- antimalware extension on the machine
- Dedicated host
- hardware not shared with others
- Trusted launch
- secure boot and virtual module
- Disk access
- private path for disk export
- Extension control
- policy restricts which extensions install
- Guest configuration
- audits settings inside the machine
Prefer platform controls that need no in-guest agent, then add agents only where the platform cannot see
Trusted launch and confidential compute
- Trusted launch adds secure boot
- A virtual module stores boot measurements
- Boot integrity monitoring raises alerts
- Confidential machines encrypt memory in hardware
- Attestation proves the environment is genuine
- Secure key release binds to attestation
Container platform controls
- Private cluster or authorized address ranges
- Policy add-on enforces pod standards
- Disallow host path mounts and privilege
- Workload identity federation for pod credentials
- Node sensor watches process behavior
- Network policy between namespaces
Container image security
- Registry scanning finds known vulnerabilities
- Runtime scanning covers running workloads
- Content trust and signed images
- Private endpoint on the registry
- Quarantine images that fail policy
- Rebuild rather than patch a container
Web application platform
- Access restrictions filter by address
- Private endpoint removes public reachability
- Client certificate setting enforces mutual authentication
- Rule priority decides evaluation order
- Managed identity replaces connection strings
- Minimum protocol version enforced
Key Vault essentials
Contents
- Keys, secrets and certificates
- Versioned objects with lifecycle dates
- Versionless references follow rotation
Protection
- Soft delete keeps deleted objects
- Purge protection blocks permanent deletion
- Firewall and network rules restrict access
Access
- Role based access replaces access policies
- Crypto service role for platform encryption
- Diagnostic logs record data plane calls
Managed modules and key custody
- Single tenant validated hardware modules
- Security domain held by the customer
- A quorum of holders protects it
- The provider cannot recover your keys
- Dedicated modules for the strictest requirements
- Symmetric material cannot be exported
Disk and host encryption
- Platform managed keys
- default encryption, nothing to configure
- Customer managed keys
- your key through an encryption set
- Double encryption
- platform key plus your key
- Encryption at host
- encrypts caches without an agent
- In-guest encryption
- agent based volume encryption
- Versionless reference
- follows rotation automatically
- Pinned key version
- rotation ignored until repointed
- Disabled key
- data becomes unreadable immediately
Storage account protections
- Disable anonymous blob public access
- Disable shared key authorization entirely
- Directory based access as the default
- Firewall denies by default, allow selectively
- Resource instance rules scope exceptions tightly
- Secure transfer and minimum protocol enforced
- Malware scanning on uploaded blobs
Shared access signatures
- Account signature
- broad, signed by account key
- Service signature
- one service, signed by key
- User delegation signature
- signed by a directory credential
- Stored access policy
- revocable without rotating keys
- Expiry
- shortest window that still works
- Address restriction
- limit to known source ranges
- Protocol
- require secure transport only
- Leakage
- a signature in a log is a key
A user delegation signature is revoked by removing the role assignment, while an account signature needs a key rotation
Database data protection
- Transparent encryption
- encrypts the files at rest
- Always Encrypted
- the client holds the column key
- Secure enclaves
- richer queries on encrypted columns
- Dynamic data masking
- hides values from unprivileged readers
- Row level security
- filters rows by the caller
- Ledger tables
- cryptographic evidence against tampering
- Classification
- labels sensitive columns automatically
- Directory authentication
- corporate identities with policy applied
Immutability and retention
- Time based retention policy locks blobs
- A locked policy resists administrator deletion
- Legal hold blocks deletion indefinitely
- Append blobs allow adding, not editing
- Versioning and soft delete for recovery
- Backup vault kept separately
Compute and data mistakes
Compute
- Management ports open to everyone
- No policy on cluster workloads
- Extensions installed without restriction
Keys
- Purge protection never enabled
- Key version pinned then rotated
- Vault reachable from the internet
Storage
- Shared key access still permitted
- Long lived account signatures issued
- A public container left in place
Service names to know
- Single tenant key hardware
- managed hardware security module
- Memory encrypted in hardware
- confidential virtual machines
- Cryptographic tamper evidence
- ledger tables
- Hide values by role
- dynamic data masking
- Column keys held by client
- Always Encrypted
- Malware scanning for blobs
- Defender for Storage
- Image and runtime coverage
- Defender for Containers
- Settings audited in guest
- guest configuration
Know the order
- Harden the image
- Restrict the network path
- Bind an identity
- Encrypt with your key
- Lock the retention
Every layer should fail closed on its own, because a private endpoint helps nothing if shared key access is still allowed
Reference strip: compute, containers, keys, storage, databases
Compute
- Just in time management access
- Trusted launch and attestation
- Dedicated hosts where required
- Guest configuration auditing
Containers
- Private cluster or address ranges
- Pod policy enforced at admission
- Registry scanning and signing
- Workload identity federation
Key custody
- Vault with soft delete
- Purge protection enabled
- Managed modules for strict custody
- Versionless references follow rotation
Storage
- Shared key access disabled
- Firewall denies by default
- User delegation signatures only
- Immutability policies locked
Databases
- Encryption at rest by default
- Always Encrypted for columns
- Masking and row filtering
- Directory authentication enforced
Quick exam traps
- Trap: Encryption at host requires an in-guest agent
- Trap: A pinned key version keeps following rotation
- Trap: Soft delete alone prevents permanent deletion of a vault
- Trap: Dynamic data masking encrypts the underlying column
- Trap: A shared access signature is revoked by deleting the file
- Trap: Trusted launch and confidential computing address the same threat
- Trap: Disabling the customer managed key leaves the data readable
cybercertprep.com · original revision sheet written from the public body of knowledge