Strong expertise with implementing security controls and threat protection, managing identity and access, and protecting data, applications, and networks in cloud and hybrid environments as part of an end-to-end infrastructure; that is what one can (and should) expect about the level of expertise of every self-respecting Security Engineer.
The Microsoft Azure Security Engineer Associate certification may be for candidates who are just starting to work with security technologies or are new to Azure, but experts may also benefit from this certification. After all, you can never have enough knowledge about security technologies.
Azure Security Engineer Associate certification covers cloud concepts, Azure services, Azure workloads, security and privacy in Azure, as well as Azure pricing and support. Microsoft states that candidates should have strong skills in scripting and automation; a deep understanding of networking, virtualization, and cloud N-tier architecture; and a strong familiarity with cloud capabilities and products and services for Azure, plus other Microsoft products and services.
Azure Security Engineer Associate may be useful to prepare you for other Azure role-based or specialty certifications but is not a prerequisite for any of them. In this blog article, I share available learning materials (free and paid) that prepare you for the Azure Security Technologies exam from Microsoft, but more importantly, these learning materials provide you with the knowledge about security technologies and Microsoft Azure security services in particular.
Before we dive into the learning materials
You want an Azure environment to build things yourself. I cannot say and emphasize this enough. Think of it as learning to drive: you can’t do that without being in a car. So, the first thing you’ll do is create your Azure environment. Via this link you can use various Azure services free of charge for 12 months.
Virtual training courses
There are various virtual training courses to follow, based on registration or on-demand. Below is an overview of the recommended virtual training events:
- Azure Security AZ-500 Certification Training Course by Cloudskills.io. Within less than 16 hours (!) of video training, Microsoft MVPs Tim Warner and Mike Pfeiffer prepare you for the Azure Security Engineer Associate (AZ-500) certification exam.
- Microsoft Azure Security Technologies (AZ-500) by Pluralsight. This learning path (consisting of 16 courses, each about an hour long) is intended to help learners start their preparation to take the Microsoft Azure Security Technologies (AZ-500) certification exam.
- Microsoft Azure Security Technologies by Technofocus. Technofocus is a Microsoft training partner. Microsoft regularly offers free training courses (including virtual labs and a voucher for a free exam) for Microsoft (Gold) partners. This 5-day training is an excellent preparation for the exam.
Microsoft Learn
Microsoft Learn provides you with free online training and learning paths for different Microsoft technologies. Here are the relevant Microsoft Learn modules and learning paths for the AZ-500 Exam:
- Secure your cloud applications in Azure - Learn | Microsoft Docs
- Implement resource management security in Azure - Learn | Microsoft Docs
- Implement network security in Azure - Learn | Microsoft Docs
- Implement virtual machine host security in Azure - Learn | Microsoft Docs
- Manage identity and access in Azure Active Directory - Learn | Microsoft Docs
- Manage security operations in Azure - Learn | Microsoft Docs
Links to Microsoft articles on the specific topics
Below are several links to articles on topics that may come up in the exam. To prepare for the exam, you’d be wise to go through these articles and, where necessary, build the components yourself in your Azure environment.
Manage identity and access
Manage Azure Active Directory identities
- configure security for service principals
- manage Azure AD directory groups
- manage Azure AD users
- configure password writeback
- configure authentication methods including password hash and Pass Through Authentication (PTA), OAuth, and passwordless
- transfer Azure subscriptions between Azure AD tenants
Configure secure access by using Azure AD
- monitor privileged access for Azure AD Privileged Identity Management (PIM)
- configure Access Reviews
- activate and configure PIM
- implement Conditional Access policies including Multi-Factor Authentication (MFA)
- configure Azure AD identity protection
Manage application access
- create App Registration
- configure App Registration permission scopes
- manage App Registration permission consent
- manage API access to Azure subscriptions and resources
Manage access control
- configure subscription and resource permissions
- configure resource group permissions
- configure custom RBAC roles
- identify the appropriate role
- apply principle of least privilege
- interpret permissions
- check access
Implement platform protection
Implement advanced network security
- secure the connectivity of virtual networks (VPN authentication, Express Route encryption)
- configure Network Security Groups (NSGs) and Application Security Groups (ASGs)
- create and configure Azure Firewall
- implement Azure Firewall Manager
- configure Azure Front Door service as an Application Gateway
- configure a Web Application Firewall (WAF) on Azure Application Gateway
- configure Azure Bastion
- configure a firewall on a storage account, Azure SQL, KeyVault, or App Service
- Configure Azure Storage firewalls and virtual networks | Microsoft Docs
- Configure Azure Firewall application rules with SQL FQDNs | Microsoft Docs
- Configure Azure Key Vault firewalls and virtual networks - Azure Key Vault | Microsoft Docs
- Azure App Service access restrictions - Azure App Service | Microsoft Docs
- Lock down outbound traffic - Azure App Service Environment | Microsoft Docs
- implement Service Endpoints
- implement DDoS protection
Configure advanced security for compute
- configure endpoint protection
- configure and monitor system updates for VMs
- configure authentication for Azure Container Registry
- configure security for different types of containers
- implement vulnerability management
- configure isolation for AKS
- configure security for container registry
- implement Azure Disk Encryption
- configure authentication and security for Azure App Service
- configure SSL/TLS certs
- configure authentication for Azure Kubernetes Service
- configure automatic updates
Manage security operations
Monitor security by using Azure Monitor
- create and customize alerts
- monitor security logs by using Azure Monitor
- configure diagnostic logging and log retention
Monitor security by using Azure Security Center
- evaluate vulnerability scans from Azure Security Center
- configure Just in Time VM access by using Azure Security Center
- configure centralized policy management by using Azure Security Center
- configure compliance policies and evaluate for compliance by using Azure Security Center
Monitor security by using Azure Sentinel
- create and customize alerts
- configure data sources to Azure Sentinel
- evaluate results from Azure Sentinel
- configure workflow automation by using Azure Sentinel
Configure security policies
- configure security settings by using Azure Policy
- configure security settings by using Azure Blueprint
- configure a playbook by using Azure Sentinel
Secure data and applications
Configure security for storage
- configure access control for storage accounts
- configure key management for storage accounts
- configure Azure AD authentication for Azure Storage
- configure Azure AD Domain Services authentication for Azure Files
- create and manage Shared Access Signatures (SAS)
- create a shared access policy for a blob or blob container
- configure Storage Service Encryption
- configure Azure Defender for Storage
Configure security for databases
- enable database authentication
- enable database auditing
- configure Azure Defender for SQL
- configure Azure SQL Database Advanced Threat Protection
- implement database encryption
- implement Azure SQL Database Always Encrypted
Configure and manage Key Vault
- manage access to Key Vault
- manage permissions to secrets, certificates, and keys
- configure RBAC usage in Azure Key Vault
- manage certificates
- manage secrets
- configure key rotation
- backup and restore of Key Vault items
- configure Azure Defender for Key Vault
Books and other reading material
Due to the rapid renewal and innovative nature of cloud and Microsoft, there is no book I would advise you. Mainly because these are quickly becoming outdated and the fact that there are much better alternatives. If you still like to use a book for studying, then there is only one suitable book: the Exam Ref AZ-500 Microsoft Azure Security Technologies by Yuri Diogenes.
Practice exams
Practice exams are useful for getting a feel for the exam questions and topics. My personal experience with practice exams is that they are often outdated, incomplete, or that the answers marked as correct in practice exams are actually incorrect. I advise everyone not to use practice exams to memorize questions and the corresponding answers, but mainly to use them to get a feel for the real exam. Below are some practice exams for the AZ-500 exam:
Good luck!
Now that we have come to the end of this article, hopefully you have discovered enough learning materials to take the AZ-500 exam with confidence. All I can do now is wish you the best of luck. Goodluck!