Introduction |
|
xv | |
Organization of this book |
|
xvi | |
Preparing for the exam |
|
xvi | |
Microsoft certifications |
|
xvi | |
Quick access to online references |
|
xvii | |
Errata, updates, & book support |
|
xvii | |
Stay in touch |
|
xvii | |
|
Chapter 1 Manage identity and access |
|
|
1 | (88) |
|
Skill 1.1 Manage Azure Active Directory identities |
|
|
1 | (37) |
|
Configure security for service principals |
|
|
2 | (4) |
|
Manage Azure AD directory groups |
|
|
6 | (7) |
|
|
13 | (2) |
|
Configure password writeback |
|
|
15 | (15) |
|
Configure authentication methods including password hash and Pass Through Authentication (PTA), OATH, and passwordless authentication |
|
|
30 | (6) |
|
Transfer Azure subscriptions between Azure AD tenants |
|
|
36 | (2) |
|
Skill 1.2 Configure secure access by using Azure AD |
|
|
38 | (26) |
|
Monitor privileged access for Azure AD Privileged Identity Management (PIM) |
|
|
38 | (2) |
|
|
40 | (3) |
|
Activate and configure PIM |
|
|
43 | (3) |
|
Implement conditional access policies including multifactor authentication |
|
|
46 | (8) |
|
|
54 | (6) |
|
Configure Azure AD Identity Protection |
|
|
60 | (4) |
|
Skill 1.3 Manage application access |
|
|
64 | (10) |
|
|
64 | (6) |
|
Configure app registration permission scopes |
|
|
70 | (1) |
|
Manage app registration permission consent |
|
|
71 | (2) |
|
Manage API access to Azure subscriptions and resources |
|
|
73 | (1) |
|
Skill 1.4 Manage access control |
|
|
74 | (12) |
|
Configure subscription and resource permissions |
|
|
74 | (5) |
|
Configure resource group permissions |
|
|
79 | (2) |
|
Identify the appropriate role |
|
|
81 | (1) |
|
Apply the principle of least privilege |
|
|
81 | (1) |
|
Configure custom RBAC roles |
|
|
81 | (3) |
|
|
84 | (1) |
|
|
84 | (2) |
|
Thought experiment answers |
|
|
86 | (1) |
|
|
87 | (2) |
|
Chapter 2 Implement platform protection |
|
|
89 | (90) |
|
Skill 2.1 Implement advanced network security |
|
|
89 | (62) |
|
Overview of Azure network components |
|
|
89 | (15) |
|
Secure the connectivity of virtual networks |
|
|
104 | (5) |
|
Configure network security groups and Application Security Groups |
|
|
109 | (8) |
|
Create and configure Azure Firewall |
|
|
117 | (9) |
|
Configure Azure Front Door service as an application gateway |
|
|
126 | (7) |
|
Configure Web Application Firewall (WAF) on Azure Application Gateway |
|
|
133 | (2) |
|
|
135 | (3) |
|
Configure resource firewall |
|
|
138 | (7) |
|
Implement service endpoint |
|
|
145 | (2) |
|
|
147 | (4) |
|
Skill 2.2 Configure advanced security for compute |
|
|
151 | (26) |
|
Configure endpoint security within the VM |
|
|
151 | (5) |
|
Configure system updates for VMs in Azure |
|
|
156 | (3) |
|
Configure authentication for containers |
|
|
159 | (2) |
|
Configure security for different types of containers |
|
|
161 | (3) |
|
Implement vulnerability management |
|
|
164 | (2) |
|
Configure isolation for AKS |
|
|
166 | (1) |
|
Configure security for container registry |
|
|
167 | (1) |
|
Implement Azure disk encryption |
|
|
168 | (2) |
|
Configure security for Azure App Service |
|
|
170 | (7) |
|
Thought experiment answers |
|
|
177 | (1) |
|
|
178 | (1) |
|
Chapter 3 Manage security operations |
|
|
179 | (64) |
|
Skill 3.1 Configure security services |
|
|
179 | (17) |
|
|
179 | (4) |
|
Create and customize alerts |
|
|
183 | (6) |
|
Configure diagnostic logging and log retention |
|
|
189 | (3) |
|
Monitoring security logs by using Azure Monitor |
|
|
192 | (4) |
|
Skill 3.2 Monitor security by using Azure Security Center |
|
|
196 | (16) |
|
Evaluate vulnerability scans from Azure Security Center |
|
|
196 | (5) |
|
Configure Just-In-Time VM access by using Azure Security Center |
|
|
201 | (5) |
|
Configure centralized policy management by using Azure Security Center |
|
|
206 | (3) |
|
Configure compliance policies and evaluate for compliance by using Azure Security Center |
|
|
209 | (3) |
|
Skill 3.3 Monitor security by using Azure Sentinel |
|
|
212 | (20) |
|
Introduction to Azure Sentinel's architecture |
|
|
212 | (1) |
|
Configure Data Sources to Azure Sentinel |
|
|
213 | (4) |
|
Create and customize alerts |
|
|
217 | (7) |
|
Configure a Playbook for a security event by using Azure Sentinel |
|
|
224 | (4) |
|
Evaluate results from Azure Sentinel |
|
|
228 | (4) |
|
Skill 3.4 Configure security policies |
|
|
232 | (9) |
|
Configure security settings by using Azure Policy |
|
|
232 | (4) |
|
Configure security settings by using Azure Blueprint |
|
|
236 | (5) |
|
Thought experiment answers |
|
|
241 | (1) |
|
|
241 | (2) |
|
Chapter 4 Secure data and applications |
|
|
243 | (68) |
|
Skill 4.1 Configure security for storage |
|
|
243 | (25) |
|
Configure access control for storage accounts |
|
|
244 | (3) |
|
Configure key management for storage accounts |
|
|
247 | (4) |
|
Create and manage Shared Access Signatures (SAS) |
|
|
251 | (4) |
|
Create a stored access policy for a blob or blob containers |
|
|
255 | (1) |
|
Configure Azure AD authentication for Azure Storage |
|
|
255 | (1) |
|
Configure Azure AD Domain Services authentication for Azure Files |
|
|
256 | (6) |
|
Configure Storage Service Encryption |
|
|
262 | (5) |
|
Advanced Threat Protection for Azure Storage |
|
|
267 | (1) |
|
Skill 4.2 Configure security for databases |
|
|
268 | (13) |
|
Enable database authentication |
|
|
268 | (2) |
|
|
270 | (3) |
|
Configure Azure SQL Database Advanced Threat Protection |
|
|
273 | (3) |
|
Implement database encryption |
|
|
276 | (3) |
|
Implement Azure SQL Database Always Encrypted |
|
|
279 | (2) |
|
Skill 4.3 Configure and manage Key Vault |
|
|
281 | (27) |
|
Manage access to Key Vault |
|
|
282 | (1) |
|
Key Vault firewalls and virtual networks |
|
|
282 | (3) |
|
Manage permissions to secrets, certificates, and keys |
|
|
285 | (2) |
|
Configure RBAC usage in Azure Key Vault |
|
|
287 | (1) |
|
|
288 | (8) |
|
|
296 | (2) |
|
|
298 | (5) |
|
Backup and restore of Key Vault items |
|
|
303 | (5) |
|
Thought experiment answers |
|
|
308 | (1) |
|
|
308 | (3) |
Index |
|
311 | |