AZ-900
Deep Dive
Multiple layers of protection, encryption, firewalls, and threat detection. Security in Azure isn't a single tool but a layered strategy where each level protects the next.
Contents
Defense in Depth is a layered security strategy. If an attacker breaks through one layer, the following layers slow down or stop the attack. No single layer is enough on its own.
Data
The most valuable layer. Encryption of data at rest and in transit. Granular access with RBAC. Regular backups.
In Azure
Azure Storage Encryption, Transparent Data Encryption in SQL, Azure Backup
Application
Secure code: input validation, no hardcoded secrets, mandatory HTTPS, secure error handling.
In Azure
Key Vault for secrets, API Management, App Service with TLS, OWASP Top 10 mitigations
Compute
Up-to-date operating systems, active antimalware, JIT (Just-in-Time) access to administrative ports.
In Azure
Microsoft Antimalware for Azure, automatic VM patches, Defender for Servers, JIT access from Defender for Cloud
Network
Network segmentation. Only allow the minimum required traffic. Deny by default. Encryption of internal traffic.
In Azure
NSG (Network Security Groups), private subnets, VNet peering, VPN Gateway, Private Endpoints
Perimeter
Protection against external network attacks: DDoS, port scanning, unauthorized access from the internet.
In Azure
Azure DDoS Protection, Azure Firewall, WAF (Web Application Firewall) on Application Gateway
Identity and access
Control who accesses what. MFA, RBAC, Conditional Access, least privilege, sign-in monitoring.
In Azure
Microsoft Entra ID, MFA, RBAC, Conditional Access, Privileged Identity Management (PIM)
Physical
Physical access to datacenters. Biometrics, 24/7 guards, CCTV, security traps. Microsoft's responsibility.
In Azure
Microsoft infrastructure: controlled access, cameras, guards, certified disk destruction
For the exam — layer order
Memorize from outside in: Physical → Identity → Perimeter → Network → Compute → Application → Data. Data is the ultimate target, which is why it's at the center (most protected).
Interactive diagram — hover over each layer
Azure encrypts data in two states: stored (at-rest) and traveling over the network (in-transit). Both are compliance requirements in virtually every regulatory framework.
Encryption at rest
Protects stored data: if someone steals a physical disk, the data is unreadable without the key.
Azure Storage
Automatic AES-256 by default. There's no option to disable it.
Azure SQL Database
TDE (Transparent Data Encryption). Encrypts the database file, logs, and backups.
Azure Disk Encryption
Encrypts VM disks using BitLocker (Windows) or DM-Crypt (Linux). Keys stored in Key Vault.
Azure Cosmos DB
Automatic AES-256. Also encrypts indexes and metadata.
Key management
Microsoft-managed keys (default, no extra cost) or Customer-managed keys (CMK) in Key Vault for full control.
Encryption in transit
Protects data moving over the network: between client and server, between Azure services, between datacenters.
TLS 1.2+
Standard for HTTPS. Azure rejects connections with TLS 1.0/1.1 on new services.
Mandatory HTTPS
App Service, Storage, API Management — "HTTPS only" option that redirects HTTP to HTTPS.
IPSec / VPN
Traffic between on-premises and Azure. VPN Gateway encrypts with IPSec/IKE.
ExpressRoute
Private connection (not over the public internet). Additional MACsec option for layer-2 encryption.
Practical rule: never HTTP in production. Always TLS 1.2+ for APIs and storage. Azure automatically encrypts internal traffic between datacenters.
Both control network traffic, but at different levels. The AZ-900 tests whether you can tell them apart.
| Dimension | NSG (Network Security Group) | Azure Firewall |
|---|---|---|
| Level | Subnet or NIC (network layer) | Entire VNet or centralized hub |
| Works with | Port, IP, protocol rules | FQDN, URLs, threat intelligence, IDPS |
| Inspection | Basic: allow/deny by 5-tuple | Deep: packet inspection, TLS inspection |
| Cost | Included (no extra cost) | Paid (~$1.25/hour + processed data) |
| Logging | Flow logs → Storage/Log Analytics | Detailed Azure Monitor logs |
| Built-in HA | Yes, automatic | Yes, automatic multi-zone |
| Use case | Segment subnets within a VNet | Perimeter protection, controlled internet egress, network hub |
Typical architecture: NSG + Firewall together
Deploy Azure Firewall in a VNet and add an FQDN-based application rule — something an NSG can't do.
+1 more...
Key Vault stores and controls access to secrets, encryption keys, and certificates. It removes the need to store credentials in source code or environment variables.
Secrets
Passwords, connection strings, API keys, OAuth tokens. Versioned: every update creates a new version.
Keys
Cryptographic keys for encryption/decryption. RSA, EC. HSM-backed (hardware security module) for maximum security.
Certificates
TLS/SSL certificates for websites and apps. Automatic renewal. Integrated with App Service, API Management, Front Door.
Recommended pattern: Managed Identity + Key Vault
Create a Key Vault and save a secret, removing the need to leave passwords or connection strings in source code.
+1 more...
Formerly called Azure Security Center + Azure Defender. It's the central platform for security posture and workload protection in Azure, on-premises, and other clouds.
Two main pillars
CSPM — Cloud Security Posture Management
Evaluates the security configuration of all your resources and generates a Secure Score (0-100%). Provides prioritized recommendations for improvement.
Free (basic features)CWP — Cloud Workload Protection
Active real-time threat detection: malware on VMs, SQL injection attacks, suspicious activity in containers, etc.
Paid (by resource type)Secure Score — how does it work?
Defender for Cloud evaluates your resources against security controls and assigns a score. Each control has a weight. Meeting more controls = higher score.
High risk
Critical misconfigurations. Unpatched vulnerabilities.
Medium risk
Important improvements pending but with a reasonable baseline.
Well protected
Most critical controls implemented.
DDoS (Distributed Denial of Service) attacks try to overwhelm services with massive traffic to make them inaccessible. Azure offers two levels of protection.
DDoS Network Protection (Basic)
Formerly called: Infrastructure Protection
Automatically enabled for all Azure customers at no extra cost. Protects Azure's infrastructure from common volumetric attacks.
DDoS IP Protection / Network Protection (Standard)
Formerly called: DDoS Standard
Paid plan. ML-driven adaptive mitigation tuned to your resources. Guaranteed SLA. Credits if the SLA is missed.
Did you get this topic?
Test what you just learned
Which Azure service provides a security score (Secure Score) and prioritized recommendations to help protect resources?
Put what you learned to the test with original AZ-900 exam questions.
Start AZ-900 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.