SC-100 flashcards
SC-100 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Assume breach principle
- A Zero Trust principle: design as if attackers are already inside by segmenting networks, minimizing blast radius, encrypting traffic, and using end-to-end analytics and threat detection.
- Defense in depth layers
- Physical, identity, perimeter, network, compute, application and data. An attacker must defeat every layer, and in cloud designs identity and data carry the most weight.
- Microsoft Cloud Security Benchmark
- The Azure control framework that Defender for Cloud Secure Score measures. It maps to standards such as NIST SP 800-53, CIS Controls and PCI DSS.
- CAF landing zone
- A pre-provisioned, governed Azure environment created in the Ready phase of the Cloud Adoption Framework, supplying identity, network, policy and logging baselines before workloads are deployed.
- STRIDE categories
- Threat modeling mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. Apply per data flow to enumerate threats against a proposed architecture.
- Shared responsibility in IaaS
- The customer owns guest OS, runtime, applications, identity and data; Microsoft owns physical hosts, network and datacenter. Responsibility shifts toward the customer as you move from SaaS to IaaS.
- Ransomware backup rule
- Keep three copies of data on two media with one offline or immutable, and enable soft delete plus immutable storage so a compromised administrator cannot purge recovery points.
- Secure Score meaning
- A percentage of implemented Microsoft Cloud Security Benchmark recommendations weighted by impact. It measures configuration posture, not runtime detection or actual compromise risk.
- Microsoft Sentinel
- Cloud-native SIEM and SOAR. Connectors ingest logs, analytics rules detect, automation rules and Logic Apps playbooks respond, and workbooks plus incident graphs support investigation.
- Conditional Access components
- Assignments of users, groups and cloud apps, plus conditions such as sign-in risk, device state, location and client app, resolved into grant controls like MFA or block.
- PIM eligible assignment
- Privileged Identity Management grants just-in-time role activation with approval, MFA, justification and a time limit, replacing permanent standing administrative access.
- Entra Identity Protection risk
- Sign-in risk and user risk detections feed risk-based Conditional Access policies. Requires Entra ID P2, and risky users can be forced through a password reset.
- Entra Permissions Management
- A cloud infrastructure entitlement management tool that discovers, right-sizes and monitors permissions across Azure, AWS and GCP to enforce least privilege and remove unused access.
- Purview sensitivity label
- Applies encryption, content marking and usage rights that persist with the file across locations, unlike a DLP policy that only acts on items in specific monitored locations.
- Compliance Manager assessment
- Maps Microsoft-managed and customer-managed controls to a regulation, lists improvement actions worth points, and computes a compliance score for that assessment in the tenant.
- Defender XDR portal
- Unified Microsoft portal that correlates incidents from Defender for Endpoint, Identity, Office 365, Cloud Apps and Sentinel, with KQL advanced hunting across those signal sources.
- Network security group
- Stateful Layer 3/4 allow and deny rules on subnets and NICs, evaluated by priority from 100 to 4096, with defaults allowing VNet traffic and denying inbound internet.
- Azure Firewall Premium
- Adds TLS inspection, intrusion detection and prevention, and URL filtering on top of Standard features such as FQDN filtering, threat intelligence and centralized Firewall Manager policy.
- Private endpoint
- Assigns a private IP from your virtual network to a PaaS service through Azure Private Link. Disabling public network access makes the private path mandatory rather than optional.
- Azure Bastion
- Provides browser or native-client RDP and SSH over TLS to virtual machines without public IP addresses or open management ports facing the internet.
- Just-in-time VM access
- A Defender for Cloud capability that creates temporary NSG allow rules for approved management ports from approved source IPs, then revokes them after the request window closes.
- Azure Policy effects
- Deny, Audit, Append, Modify, DeployIfNotExists and AuditIfNotExists. Modify and DeployIfNotExists need a managed identity on the assignment plus a remediation task for existing resources.
- Key Vault versus Managed HSM
- Key Vault Standard and Premium hold keys in software or a FIPS 140-2 Level 2 HSM. Managed HSM provides single-tenant, FIPS 140-3 Level 3 validated hardware key custody.
- Defender for Cloud CSPM
- Multicloud posture management scoring resources against the Microsoft Cloud Security Benchmark, with optional workload protection plans for servers, storage, SQL, containers, Key Vault and App Service.
- Managed identity
- An Entra ID service principal bound to an Azure resource that obtains tokens without stored secrets. System-assigned shares the resource lifecycle; user-assigned is standalone and shareable.
- Always Encrypted
- A SQL feature where the client driver encrypts designated columns so the database engine never sees plaintext. It protects data in use but blocks server-side operations on those columns.
- Transparent Data Encryption
- Encrypts database, log and backup files at rest using a server or database key, or a customer-managed key held in Key Vault for revocation and control.
- Secret scanning
- A GitHub Advanced Security capability that detects committed credentials, alerts repository owners, can block pushes, and notifies partner providers so exposed tokens are revoked.
- Confidential computing
- Uses hardware trusted execution environments so data is encrypted while in use, and the host operating system and hypervisor cannot read enclave memory.
- Sensitivity label encryption
- Purview encryption uses Azure Rights Management to bind usage rights such as view, edit and print to identities, so protection persists after the file leaves the tenant.
- Customer Lockbox
- Requires explicit, audited, time-limited customer approval before a Microsoft support engineer can access tenant data while resolving a support incident.
- DevOps security in Defender
- Connects GitHub and Azure DevOps repositories so code, secret, dependency and infrastructure-as-code scanning findings surface as security recommendations in Defender for Cloud.