# PART 7: SECURITY SERVICES

---

## 7.1 Microsoft Defender for Cloud

### Overview
Cloud Security Posture Management (CSPM) + Cloud Workload Protection (CWP). Secures multi-cloud and on-prem resources.

### Key Features
- **Secure Score** — Percentage-based score of your security posture. Based on recommendations.
- **Recommendations** — Actionable steps to improve security. Categorized: Network, Identity, Data, Compute.
- **Regulatory Compliance** — Compare posture against standards (ISO 27001, NIST, PCI DSS, SOC 2, etc.).
- **Asset Inventory** — View all resources and their security status.
- **Workflow Automation** — Auto-respond to recommendations/alerts.

### Defender Plans (Workload Protection)
| Plan | Protects |
|---|---|
| **Defender for Servers** | VMs, on-prem servers. Vulnerability scanning, EDR (MDE), JIT VM access |
| **Defender for App Service** | Web app threat detection |
| **Defender for SQL** | SQL Server (on-prem, Azure SQL, VM). Vulnerability assessment, threat detection |
| **Defender for Storage** | Blob, Files, Data Lake. Malware scanning, data exfiltration detection |
| **Defender for Containers** | AKS, ACR, Container Apps. Image scanning, K8s threat detection |
| **Defender for Key Vault** | Threat detection for Key Vault |
| **Defender for DNS** | DNS-layer threat detection |
| **Defender for IoT** | IoT/OT device security |
| **Defender for Databases** | Open-source databases (PostgreSQL, MySQL, MariaDB) |

### JIT VM Access
- Reduce attack surface by opening RDP/SSH ports only when needed
- Request access → approved → port opened for limited time → auto-closed
- Must-have for internet-facing VMs

### Interview Q&A
**Q: What is Secure Score?**
A: Measures your security posture (0-100%). Based on completed vs total recommendations. Higher = more secure. Used to prioritize remediation. Track over time.

---

## 7.2 Microsoft Sentinel

### Overview
Cloud-native SIEM (Security Information and Event Management) + SOAR (Security Orchestration, Automation, and Response). Built on Log Analytics.

### Key Components
- **Data Connectors** — Ingest logs from M365, Azure, third-party (Cisco, Palo Alto, etc.)
- **Analytics (Rules)** — Detect threats. Scheduled, real-time, ML-based, fusion.
- **Incidents** — Group related alerts into incidents for investigation.
- **Workbooks** — Interactive dashboards for visualization.
- **Playbooks** — Automated response (Logic Apps-based). Auto-remediate threats.
- **Hunting** — Proactive threat hunting with KQL queries.
- **Watchlists** — Custom lists for enrichment (e.g., VIP users, malicious IPs).
- **Threat Intelligence** — Integrate TI feeds. Use in analytics rules.

### Key Features
- **UEBA (User and Entity Behavior Analytics)** — ML-based anomaly detection. Establishes baselines.
- **SOAR** — Automate response with playbooks (Logic Apps). E.g., block IP, disable user, isolate VM.
- **ML-based detection** — Fusion (multi-stage attack detection), anomaly detection.
- **KQL (Kusto Query Language)** — Query language for hunting and analytics rules.

### Interview Q&A
**Q: What is Sentinel and why use it?**
A: Cloud-native SIEM + SOAR. No infrastructure to manage. Scales automatically. Pay per GB ingested. Centralize security logs, detect threats, automate response.

---

## 7.3 Azure Policy

### Overview
Enforce organizational rules and compliance at scale. Evaluate resources against policies. Prevent non-compliant resources.

### Key Concepts
- **Policy Definition** — Rule (if condition → deny/audit/modify/append/deployIfNotExists)
- **Policy Assignment** — Apply definition to scope (MG, subscription, RG)
- **Policy Parameters** — Make policies reusable (e.g., allowed regions list)
- **Initiative Definition** — Group of policy definitions (e.g., "ISO 27001 compliance")
- **Exemptions** — Exclude specific resources from policies

### Effects
| Effect | What Happens |
|---|---|
| **Deny** | Block non-compliant resource creation/update |
| **Audit** | Log non-compliance (no block) |
| **AuditIfNotExists** — Audit if related resource doesn't exist |
| **DeployIfNotExists** — Auto-deploy if missing (e.g., auto-deploy diagnostics) |
| **Modify** — Add/modify properties (e.g., add tags) |
| **Disabled** | Policy not evaluated |

### Common Policies
- Allowed locations (restrict regions)
- Allowed resource types
- Require tags
- Enforce encryption
- Auto-deploy diagnostics settings
- Prevent public endpoints

### Interview Q&A
**Q: Azure Policy vs RBAC?**
A: RBAC = who can do what (permissions). Policy = what is allowed/compliant (rules). They're complementary. RBAC controls access; Policy controls what resources can look like.

---

## 7.4 Azure Blueprints

### Overview
Package of policies + RBAC + ARM templates for repeatable compliance. Deploy a compliant environment in one shot.

- Blueprint = Policy Assignments + Role Assignments + ARM Templates + Resource Groups
- Version controlled
- Artifact locking (prevent drift)
- For compliance scenarios (deploy compliant landing zones)

---

## 7.5 Azure WAF (Web Application Firewall)

### Overview
Protect web apps from common attacks (OWASP Top 10). Runs on Application Gateway or Front Door.

### Key Features
- **Rule Sets** — OWASP 3.2, 3.1, 3.0, 2.2.1
- **Custom Rules** — Match conditions (IP, header, URI, geo) → allow/deny
- **Exclusions** — Bypass WAF for specific fields (e.g., large file uploads)
- **Policy** — Centralized WAF policy applied across multiple App Gateways/Front Doors

### WAF Modes
- **Detection mode** — Log but don't block (testing)
- **Prevention mode** — Block and log (production)

---

## 7.6 Azure Confidential Computing

### Overview
Encrypt data in use using Trusted Execution Environments (TEEs). Data is encrypted at rest, in transit, AND in use.

- **DC-series VMs** — SGX-enabled Intel processors
- **AKS Confidential Containers** — Run containers in enclaves
- **Azure Attestation** — Remote verification of TEE environment
- For: financial data, healthcare records, multi-party computation
