Azure AZ-500 flashcards
Azure AZ-500 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Entra ID versus Azure RBAC
- Microsoft Entra ID roles control directory objects such as users and groups; Azure RBAC roles control management of Azure resources. The two systems are separate and assignments do not automatically grant the other.
- Conditional Access signals
- Conditional Access evaluates user or group membership, device platform and state, location, application, and sign-in risk; access is granted only when configured grant controls are satisfied.
- PIM eligible assignment
- An eligible Microsoft Entra or Azure RBAC role assignment in Privileged Identity Management requires activation before use and can enforce approval, MFA, justification, and a maximum activation duration.
- System-assigned managed identity
- A managed identity created automatically with an Azure resource and tied to its lifecycle; deleting the resource deletes the identity, and it cannot be shared with another resource.
- User-assigned managed identity
- A standalone managed identity created as an Azure resource that can be attached to multiple Azure resources and persists independently of any single resource lifecycle.
- Azure RBAC deny assignment
- A deny assignment blocks specified actions for users or groups at a scope and takes precedence over allow assignments; it is typically created by managed services such as Blueprints or managed applications.
- Custom role AssignableScopes
- AssignableScopes defines the management groups, subscriptions, or resource groups where a custom Azure RBAC role can be assigned; omitting it limits the role to the defining scope.
- SSPR password writeback
- Self-service password reset writeback sends password changes from Microsoft Entra ID to an on-premises directory; it requires Microsoft Entra ID P1 and a supported on-premises agent configuration.
- NSG priority evaluation
- Network security group rules are processed from lowest priority number to highest; the first matching rule determines allow or deny, and later rules are not evaluated.
- Application security group
- An application security group groups network interfaces of virtual machines so NSG rules can allow or deny traffic based on application role rather than IP address.
- Azure Firewall application rules
- Azure Firewall application rules allow or deny outbound HTTP and HTTPS traffic based on fully qualified domain names, and can include URL filtering in the Premium SKU.
- Private endpoint
- A private endpoint is a network interface with a private IP address in a subnet that connects privately to a PaaS service through Azure Private Link.
- Service endpoint
- A service endpoint extends the virtual network identity to an Azure PaaS service over the Azure backbone; it does not assign a private IP address to the service.
- Azure Bastion
- Azure Bastion provides browser-based RDP and SSH access to virtual machines through the Azure portal without public IP addresses or open RDP/SSH internet ports.
- IP flow verify
- Network Watcher IP flow verify tests whether a packet is allowed or denied to or from a VM and identifies the NSG rule responsible for the decision.
- Route-based VPN gateway
- A route-based Azure VPN gateway uses routes and supports BGP, multiple site-to-site connections, and point-to-site; policy-based gateways use static routing with one tunnel.
- Storage shared key
- Shared key authorization uses the storage account access key to sign requests; it grants full access to the account and is not recommended when Microsoft Entra ID authorization is available.
- User delegation SAS
- A user delegation SAS is a shared access signature secured with Microsoft Entra ID credentials rather than the storage account key, and it is supported only for Azure Blob storage.
- Trusted Microsoft services exception
- The storage firewall option allows trusted Azure services such as Azure Backup and Azure Site Recovery to access the storage account even when public network access is restricted.
- TDE customer-managed key
- Transparent data encryption can use a customer-managed key stored in Azure Key Vault or Managed HSM; the database encrypts data and log files at rest using that key.
- Always Encrypted
- Always Encrypted encrypts sensitive database columns on the client so the database engine never sees plaintext; column encryption keys are wrapped by a column master key.
- Key Vault purge protection
- Purge protection prevents permanent deletion of a Key Vault or its objects during the soft-delete retention period, even by an authorized user, until the period expires.
- Just-in-time VM access
- Just-in-time VM access in Microsoft Defender for Cloud opens selected NSG ports only for an approved source IP and time window, then closes them automatically.
- AKS private cluster
- In an AKS private cluster the Kubernetes API server endpoint has a private IP address, so access requires a network path such as a jump box, VPN, or ExpressRoute.
- Secure score
- Microsoft Defender for Cloud secure score is a percentage that measures security posture based on completed recommendations; improving resource configurations increases the score.
- Defender for Servers Plan 2
- This plan adds file integrity monitoring, adaptive application controls, just-in-time VM access, and endpoint detection and response beyond the foundational server protections.
- Adaptive application controls
- Adaptive application controls learn which applications run on a VM and recommend an allowlist; enforced mode blocks applications that are not on the approved list.
- Scheduled analytics rule
- A Microsoft Sentinel scheduled analytics rule runs a KQL query at a defined frequency and lookback period, and creates alerts or incidents when results match.
- Sentinel automation playbook
- A playbook is an Azure Logic App that Microsoft Sentinel can trigger from an incident or alert to perform automated response actions such as isolating a machine or notifying a team.
- Sentinel data connector
- A Microsoft Sentinel data connector configures ingestion from a source such as Microsoft 365 Defender, Azure Activity, Microsoft Entra ID, or syslog into the Log Analytics workspace.
- Regulatory compliance dashboard
- Defender for Cloud regulatory compliance maps security recommendations and assessments to standards such as PCI DSS, ISO 27001, and the Microsoft cloud security benchmark.
- Fusion analytics rule
- Microsoft Sentinel Fusion uses machine learning to correlate alerts from multiple products into high-fidelity incidents, reducing alert fatigue from isolated detections.