AZ-900 Microsoft Azure Fundamentals Exam

Assess Risk Management and Threat Protection

In cloud computing, risk management and threat protection keep applications available and secure. A distributed denial of service (DDoS) attack is a major threat that tries to overwhelm resources, making services inaccessible to real users. Understanding and mitigating these attacks is a key benefit of security and governance in the cloud.

Azure DDoS Protection is a built-in service that defends against DDoS attacks at the network layers (Layer 3 and 4). It is automatically tuned to your specific virtual network and begins protecting your resources without requiring any changes to your applications. Enabling the service on a new or existing network is simple and fast, giving you immediate protection.

Azure offers two tiers of DDoS Protection to match different needs. DDoS Network Protection provides core mitigation features and automatic tuning for resources in a virtual network. DDoS IP Protection adds value-added services like rapid response support, cost protection, and discounts on Web Application Firewall (WAF).

Key features of Azure DDoS Protection include always-on traffic monitoring for 24/7 analysis of traffic to detect and stop attacks, and adaptive real-time tuning that uses machine learning to profile your traffic over time and adjusts defenses. The service also provides attack analytics with detailed reports during and after an attack, attack metrics available through Azure Monitor, and configurable alerts for the start, stop, and duration of attacks. These capabilities help you maintain resiliency, meet compliance standards, and strengthen your overall security posture in the cloud.

Implement Best Practices for Security and Governance

Security and governance in the cloud are essential for maintaining a secure and compliant environment. In Azure, tools like Microsoft Defender for Cloud and Microsoft Entra Permissions Management play a crucial role in managing security and governance. These tools help organizations enforce the principle of least privilege, ensuring users have only the access necessary to perform their tasks, thereby reducing the risk of security breaches.

Microsoft Defender for Cloud is a comprehensive security solution that focuses on securing cloud-native applications. It provides visibility into application behavior and security posture, helping organizations detect potential threats and maintain compliance with regulatory standards. By integrating Permissions Management, Defender for Cloud can prevent security breaches due to excessive permissions or misconfigurations, making it an essential tool for protecting sensitive data in the cloud.

Microsoft Entra Permissions Management is a critical component for managing user access and entitlements in cloud infrastructure. It provides fine-grained access controls and permissions across multicloud environments, ensuring that access rights align with the principle of least privilege. This helps organizations reduce their attack surface and maintain compliance with security standards, making Permissions Management a vital part of a robust security strategy.

Azure RBAC is a system that enables granular access management of Azure resources by combining permissions into roles. It helps ensure that users have the appropriate access to resources, supporting the best practice of least privilege. By assigning roles like Reader or Contributor, organizations can manage access to both management and data layers, ensuring secure and efficient operations in Azure.

Evaluate Governance Strategies in Azure

Azure governance is essential to secure and manage cloud resources effectively. At its core, Azure Resource Manager provides a framework for organizing resources into scopes such as subscriptions, resource groups, and management groups. Using governance strategies like role-based access control (RBAC) helps ensure only authorized users can perform actions on resources. Effective governance protects organizational data and streamlines operations.

One key governance strategy is Azure RBAC, which uses security principals to assign permissions. The main types of security principals include a user (an individual identity in Microsoft Entra ID), a group (a collection of users that share assigned permissions), a service principal (an identity for applications or services), and a managed identity (an automatically managed identity for Azure resources). This model ensures granular control over who can access and manage Azure assets.

Permissions in Azure are grouped into role definitions, often called roles. Roles are either job function roles or privileged administrator roles. Common job function roles include Virtual Machine Contributor for VM management and Storage Blob Data Reader for read-only access to storage blobs. Choosing the most restrictive role necessary helps maintain the principle of least privilege.

Azure RBAC assignments are transitive and additive. If a user is in a group that has a role, the user inherits that role across nested groups. When multiple roles overlap, Azure sums their permissions to form the user's effective permissions. This additive model simplifies governance by allowing layered permissions while maintaining clarity.

Azure evaluates access requests through a step-by-step process. First, a security principal presents a token to Azure Resource Manager. Then, Azure gathers all role and deny assignments for the requested scope. If no deny assignments block access, Azure checks if the requested action is allowed by the principal's roles. Conditional assignments, if any, are evaluated. Finally, access is granted or denied based on this evaluation. This process ensures consistent and secure access control across all Azure regions.

Understand Compliance and Regulatory Benefits

Azure Policy and Azure role-based access control (Azure RBAC) work together to help organizations meet compliance and regulatory requirements in the cloud. Azure Policy evaluates the state of resources against your business rules, ensuring that resources remain compliant regardless of who makes changes. In contrast, Azure RBAC controls user permissions at different scopes to manage who can perform specific actions. Together, they provide a complete governance solution in Azure, helping you enforce policies and control access.

Azure Policy uses definitions, initiatives, and assignments to enforce compliance rules across subscriptions and resource groups. You can start with an audit effect to see how policies impact your environment and then move to enforcement effects like deny, modify, or deployIfNotExists. All policy objects are readable by users with access at the assigned scope, providing transparency. This approach helps you identify non-compliant resources before they affect your operations.

Azure RBAC focuses on granting the minimum necessary permissions for users to perform tasks. Built-in roles like Owner, Contributor, and Reader include varying levels of Azure Policy permissions, while the Resource Policy Contributor role covers most policy operations. If built-in roles do not fit your needs, you can create a custom role with only the permissions required. Using least privilege ensures that only authorized users can change policy definitions or grant access.

Recommended practices to maintain strong governance and compliance in Azure include starting with audit effects to review policy impact before enforcement, applying policies at higher levels (management group or subscription) to follow organizational hierarchies, granting only the minimum permissions needed and using custom roles if necessary, and for specialized scenarios like Azure Virtual Network Manager, ensuring Azure RBAC roles include the required join and policy permissions. By combining Azure Policy and Azure RBAC, you ensure that your resources remain compliant with industry standards and regulations while controlling who can make changes.

Comprehend Azure Security Features

Security and governance in the cloud bring consistent protection and compliance for an organization's data and applications. By using Azure's built-in tools, companies can enforce policies, monitor risks, and respond to threats more quickly than with on-premises solutions. This approach also helps reduce manual work, lowers the chance of human error, and supports industry standards and regulations.

Azure provides several core security services to protect resources. Key offerings include Azure Active Directory for identity management and access control, Azure Key Vault for secure key management and secrets storage, and Azure Security Center for continuous security posture monitoring and threat detection.

Azure Key Vault lets you store encryption keys, certificates, and secrets in hardware-protected modules. You can use customer-managed keys and bring your own key (BYOK) scenarios to maintain full control over your encryption keys. Data encrypted by Key Vault never leaves the secure boundary of the hardware security module, ensuring robust data protection at rest.

Azure Security Center continuously assesses your cloud environment and helps enforce baseline configurations across your resources. It provides real-time threat protection, vulnerability scanning and remediation recommendations, and integration with policy management for compliance reporting.

Finally, Azure governance features help organizations manage risk and ensure consistent configuration. Services like Azure Policy and Azure Blueprints let you define rules and deploy repeatable environments, ensuring that every resource meets organizational standards. This level of control supports scalable, secure, and compliant cloud operations.