Muutke küpsiste eelistusi

Exam Ref SC-100 Microsoft Cybersecurity Architect [Pehme köide]

  • Formaat: Paperback / softback, 352 pages, kõrgus x laius x paksus: 230x186x17 mm, kaal: 640 g
  • Sari: Exam Ref
  • Ilmumisaeg: 06-Mar-2023
  • Kirjastus: Addison Wesley
  • ISBN-10: 0137997302
  • ISBN-13: 9780137997305
Teised raamatud teemal:
  • Formaat: Paperback / softback, 352 pages, kõrgus x laius x paksus: 230x186x17 mm, kaal: 640 g
  • Sari: Exam Ref
  • Ilmumisaeg: 06-Mar-2023
  • Kirjastus: Addison Wesley
  • ISBN-10: 0137997302
  • ISBN-13: 9780137997305
Teised raamatud teemal:

Prepare for Microsoft Exam SC-100 and demonstrate your real-world mastery of skills and knowledge needed to design and evolve cybersecurity strategy for all aspects of enterprise architecture. Designed for experienced IT professionals, this Exam Ref focuses on critical thinking and decision-making acumen needed for success at the Microsoft Certi ed: Cybersecurity Architect Expert level.

Focus on the expertise measured by these objectives:

  • Design a Zero Trust strategy and architecture
  • Evaluate Governance Risk Compliance (GRC) technical strategies and security operations strategies
  • Design a strategy for data and applications
  • Recommend security best practices and priorities

This Microsoft Exam Ref:

  • Organizes its coverage by exam objectives
  • Features strategic, what-if scenarios to challenge you
  • Assumes you have advanced security engineering experience and knowledge and experience with hybrid and cloud implementations

About the Exam

Exam SC-100 focuses on the knowledge needed to build overall security strategy and architecture; design strategies for security operations, identity security, and regulatory compliance; evaluate security posture; recommend technical strategies to manage risk; design strategies to secure server endpoints, client endpoints, and SaaS, PaaS, and IaaS services; specify application security requirements; design data security strategy; recommend security best practices based on Microsoft Cybersecurity Reference Architecture and Azure Security Benchmarks; use the Cloud Adoption Framework to recommend secure methodologies; use Microsoft Security Best Practices to recommend ransomware strategies.

About Microsoft Certi cation

The Microsoft Certi ed: Cybersecurity Architect Expert certi cation credential demonstrates your ability to plan and implement cybersecurity strategy that meets business needs and protects the organization’s mission and processes across its entire enterprise architecture. To ful ll your requirements, pass this exam and earn one of these four prerequisite certi cations: Microsoft Certi ed: Azure Security Engineer Associate; Microsoft Certi ed: Identity and Access Administrator Associate; Microsoft365 Certi ed: Security Administrator Associate; Microsoft Certi ed: Security Operations Analyst Associate.

See full details at: microsoft.com/learn

Introduction xix
Organization of this book xix
Preparing for the exam xx
Microsoft certifications xx
Quick access to online references xx
Errata, updates, & book support xxi
Stay in touch xxi
Chapter 1 Build an overall security strategy and architecture
1(26)
Security architecture
2(1)
Security architects
3(2)
Architects work across teams and roles
5(1)
Zero Trust transformation and security architects
5(2)
Security architects are critical to Zero Trust
6(1)
Skill 1-1 Identify the integration points in an architecture by using Microsoft Cybersecurity Reference Architectures (MCRA)
7(4)
MCRA and Cloud Adoption Framework Secure Methodology
7(3)
How to use the MCRA to identify integration points
10(1)
Skill 1-2 Translate business goals into security requirements
11(2)
Translation process
12(1)
Skill 1-3 Translate security requirements into technical capabilities, including security services, security products, and security processes
13(4)
Requirement: Mitigate compromise of accounts using password spray and other credential compromise
15(1)
Requirement: Shorten response times to attacks across resources in the environment
16(1)
Requirement: Integrate network security into Infrastructure as Code (laC) automation
16(1)
Requirement: Enable eDiscovery processes for Office 365 data
16(1)
Skill 1-4 Design security for a resiliency strategy
17(2)
Reducing risk by reducing critical security events
17(1)
Resilience requires shifting from a network-centric to an asset- and data-centric mindset
18(1)
Skill 1-5 Integrate a hybrid or multi-tenant environment into a security strategy
19(2)
Skill 1-6 Develop a technical governance strategy for security
21(1)
Thought experiment
22(1)
Tailoring security technology to different business scenarios
22(1)
Thought experiment answers
23(2)
Chapter summary
25(2)
Chapter 2 Design a security operations strategy
27(28)
Skill 2-1 Design a logging and auditing strategy to support security operations
27(5)
Centralizing log collection
28(1)
Deciding which logs have security value
28(1)
Designing security operations use cases
29(2)
Determining log retention periods
31(1)
Skill 2-2 Develop security operations to support a hybrid or multi-cloud environment
32(5)
Cross-platform log collection
32(1)
Cloud security posture management (CSPM)
33(2)
Focus on identity
35(1)
Internet of Things (loT) / Operational Technology (OT) coverage
36(1)
Skill 2-3 Design a strategy for SIEM and SOAR
37(3)
Microsoft Security Operations Reference Architecture
37(1)
Ingest logs into your SIEM
38(1)
Automate, automate, automate
39(1)
Skill 2-4 Evaluate security workflows
40(5)
General incident response workflow
41(3)
Automation, automation, automation (again)
44(1)
Skill 2-5 Evaluate a security operations strategy for the incident management lifecycle
45(5)
Microsoft's approach to security incident management
46(1)
Preparation
47(1)
Detection and analysis
47(1)
Containment
48(1)
Eradication
48(1)
Recovery
49(1)
Post-incident activity
49(1)
Skill 2-6 Evaluate a security operations strategy for sharing technical threat intelligence
50(2)
Microsoft's threat intelligence strategy
50(1)
Sharing technical threat intelligence in your organization
51(1)
Thought experiment
52(1)
Security operations strategy at Contoso Ltd.
52(1)
Thought experiment answers
53(1)
Chapter summary
53(2)
Chapter 3 Design an identity security strategy
55(54)
Skill 3-1 Design a strategy for access to cloud resources
56(8)
Identity-related access controls
56(1)
Network-related access controls
57(1)
Coordinated identity and network access
57(1)
Interconnection and cross-service collaboration
58(3)
Assume-breach and explicitly verify
61(1)
People, process, and technology approach
61(3)
Skill 3-2 Recommend an identity store (tenants, B2B, B2C, and hybrid)
64(5)
Foundational implementations
65(1)
External collaboration
66(3)
Skill 3-3 Recommend an authentication strategy
69(13)
Enterprise accounts
69(8)
Specialized accounts
77(1)
Controlling authentication sessions
78(2)
Key recommendations
80(2)
Skill 3-4 Recommend an authorization strategy
82(8)
Configuring access to support authorization
82(6)
Decentralized identities
88(1)
Key recommendations
89(1)
Skill 3-5 Design a strategy for conditional access
90(4)
Key recommendations
92(2)
Skill 3-6 Design a strategy for role assignment and delegation
94(5)
Delegating to non-administrators
95(2)
Delegating access to service providers
97(2)
Skill 3-7 Design security strategy for privileged-role access to infrastructure, including identity-based firewall rules and Azure PIM
99(5)
Privileged Access Workstation (PAW)
99(1)
Privileged Identity Management (PIM)
100(3)
Microsoft Entra Permissions Management
103(1)
Key recommendations
104(1)
Skill 3-8 Design security strategy for privileged activities, including PAM, entitlement management, and cloud tenant administration
104(2)
Privileged Access Workstation (PAW)
105(1)
Privileged Identity Management (PIM)
105(1)
Microsoft Entra Permissions Management
106(1)
Thought experiment
106(1)
Thought experiment answers
107(1)
Chapter summary
108(1)
Chapter 4 Design a regulatory compliance strategy
109(26)
Overview of security governance
109(5)
Skill 4-1 Interpret compliance requirements and translate into specific technical capabilities (new or existing)
114(5)
Security compliance translation process
116(1)
Resolving conflicts between compliance and security
117(2)
Skill 4-2 Evaluate infrastructure compliance by using Microsoft Defender for Cloud
119(2)
Skill 4-3 Interpret compliance scores and recommend actions to resolve issues or improve security
121(1)
Skill 4-4 Design implementation of Azure Policy
122(1)
Skill 4-5 Design for data residency requirements
123(1)
Skill 4-6 Translate privacy requirements into requirements for security solutions
124(3)
Security and privacy
125(2)
Thought experiment
127(1)
Building repeatable technical patterns for security compliance
127(1)
Thought experiment answers
128(4)
Chapter summary
132(3)
Chapter 5 Evaluate security posture and recommend technical strategies to manage risk
135(24)
Skill 5-1 Evaluate security posture by using benchmarks (including Azure security benchmarks for Microsoft Cloud security benchmark, ISO 27001, etc.)
135(1)
Microsoft cloud security benchmark
136(3)
Monitoring your MCSB compliance
136(2)
Industry standards
138(1)
Skill 5-2 Evaluate security posture by using Microsoft Defender for Cloud
139(5)
Defender for Cloud
139(1)
Security posture management
140(2)
Considerations for multi-cloud
142(1)
Considerations for vulnerability assessment
143(1)
Skill 5-3 Evaluate security posture by using Secure Scores
144(2)
Secure Score in Defender for Cloud
144(2)
Skill 5-4 Evaluate security posture of cloud workloads
146(2)
Workload security
146(2)
Skill 5-5 Design security for an Azure Landing Zone
148(3)
Design principles
149(1)
Enforcing guardrails
149(1)
Single management plane
150(1)
Application-centric
150(1)
Security considerations
150(1)
Skill 5-6 Interpret technical threat intelligence and recommend risk mitigations
151(3)
Threat intelligence in Defender for Cloud
151(2)
Threat intelligence in Microsoft Sentinel
153(1)
Skill 5-7 Recommend security capabilities or controls to mitigate identified risks
154(2)
Identifying and mitigating risk
154(2)
Thought experiment
156(1)
Monitoring security at Fabrikam Inc
156(1)
Thought experiment answers
157(1)
Chapter summary
157(2)
Chapter 6 Design a strategy for securing server and client endpoints
159(48)
Skill 6-1 Specify security baselines for server and client endpoints
160(7)
Group Policy Objects (GPO)
160(1)
Security Compliance Toolkit (SCT)
161(1)
Azure Security Benchmark (ASB)
161(1)
Microsoft Endpoint Manager (MEM)
162(1)
PowerShell DSC
163(1)
Azure Automation
163(1)
Azure Policy
163(2)
Azure Resource Manager (ARM) templates
165(1)
Blueprints
165(1)
Microsoft Defender for Cloud (MDC)
166(1)
Microsoft Defender for IoT (MDIoT)
166(1)
Baseline configuration
166(1)
Key Recommendations
167(1)
Skill 6-2 Specify security requirements for servers, including multiple platforms and operating systems
167(9)
Shared responsibility in the cloud
168(1)
Legacy insecure protocols
169(1)
Threat protection
170(1)
Local Administrator Password Management (LAPS)
171(1)
User rights assignments
171(1)
Network-based controls
172(2)
Governance
174(2)
Skill 6-3 Specify security requirements for mobile devices and clients, including endpoint protection, hardening, and configuration
176(7)
Local Administrator Password Management
176(1)
Basic Mobility and Security
176(1)
Threat protection
177(1)
Conditional access
177(1)
Microsoft Intune
178(1)
User right assignments
179(1)
Micro-segmentation
180(1)
Governance
180(2)
Other security controls
182(1)
Skill 6-4 Specify requirements to secure Active Directory Domain Services
183(8)
Secure the control plane
183(4)
Privileged Access Management
187(1)
Key recommendations
188(1)
Microsoft Defender for Identity
188(2)
Active Directory Federation Services (AD FS)
190(1)
Skill 6-5 Design a strategy to manage secrets, keys, and certificates
191(5)
Access control
192(1)
Configuration control
193(1)
Key management
194(1)
Key recommendations
194(2)
Skill 6-6 Design a strategy for secure remote access
196(7)
Key configurations to enable secure remote access
196(2)
Remote access to desktop, applications, and data
198(2)
Remote access to on-premises web applications
200(1)
RDP/SSH connectivity
201(1)
Remotely provisioning new devices
202(1)
B2B collaboration
202(1)
Key recommendations
202(1)
Thought experiment
203(1)
Thought experiment answers
203(1)
Chapter summary
204(3)
Chapter 7 Design a strategy for securing SaaS, PaaS, and IaaS services
207(20)
Skill 7-1 Specify security baselines for SaaS, PaaS, and IaaS services
207(2)
Specify security baselines for SaaS services
208(1)
Skill 7-2 Specify security requirements for IoT workloads
209(2)
Security requirements
209(1)
Security posture and threat detection
210(1)
Skill 7-3 Specify security requirements for data workloads, including SQL, Azure SQL Database, Azure Synapse, and Azure Cosmos DB
211(4)
Security considerations for Azure Cosmos DB
214(1)
Skill 7-4 Specify security requirements for web workloads, including Azure App Service
215(2)
Network communication
215(1)
Authentication and authorization
216(1)
Security posture and threat protection
216(1)
Skill 7-5 Specify security requirements for storage workloads, including Azure Storage
217(3)
Data protection
217(2)
Identity and access management
219(1)
Networking
220(1)
Logging and monitoring
220(1)
Skill 7-6 Specify security requirements for containers
220(2)
Hardening access to Azure Container Registry
221(1)
Skill 7-7 Specify security requirements for container orchestration
222(2)
Threat detection
223(1)
Thought experiment
224(1)
Design a strategy for securing PaaS and laaS services at Fabrikam, Inc
224(1)
Thought experiment answers
224(1)
Chapter summary
225(2)
Chapter 8 Specify security requirements for applications
227(16)
Skill 8-1 Specify priorities for mitigating threats to applications
227(5)
Classifying applications
228(1)
Application threat modeling
228(1)
Microsoft Security Development Lifecycle (SDL)
229(3)
Skill 8-2 Specify a security standard for onboarding a new application
232(5)
Old versus new
232(1)
Security standards for onboarding applications
233(4)
Skill 8-3 Specify a security strategy for applications and APIs
237(3)
Waterfall to Agile/DevOps
237(2)
Security in DevOps (DevSecOps)
239(1)
Thought experiment
240(1)
Application migration and modernization at Fabrikam, Inc.
240(1)
Thought experiment answers
241(1)
Chapter summary
241(2)
Chapter 9 Design a strategy for securing data
243(18)
Skill 9-1 Specify priorities for mitigating threats to data
243(3)
Common threats
243(3)
Prioritization
246(1)
Skill 9-2 Design a strategy to identify and protect sensitive data
246(7)
Know your data
247(1)
Protect your data
248(2)
Prevent data loss
250(1)
Govern your data
251(2)
Skill 9-3 Specify an encryption standard for data at rest and in motion
253(5)
Encryption at rest
253(2)
Encryption in motion
255(3)
Thought experiment
258(1)
Design a strategy for securing data
258(1)
Thought experiment answers
259(1)
Chapter summary
259(2)
Chapter 10 Microsoft Cybersecurity Reference Architectures and Microsoft cloud security benchmark best practices
261(28)
What are best practices?
262(8)
Antipatterns are the opposites of best practices
262(4)
Microsoft Cybersecurity Reference Architectures (MCRA)
266(2)
Microsoft cloud security benchmark (MCSB)
268(2)
Skill 10-1 Recommend best practices for cybersecurity capabilities and controls
270(3)
Skill 10-2 Recommend best practices for protecting from insider and external attacks
273(4)
Skill 10-3 Recommend best practices for Zero Trust security
277(3)
Skill 10-4 Recommend best practices for the Zero Trust Rapid Modernization Plan
280(2)
Thought experiment
282(1)
Identifying applicable best practices
282(1)
Thought experiment answers
282(3)
Chapter summary
285(4)
Chapter 11 Recommend a secure methodology by using the Cloud Adoption Framework (CAF)
289(14)
Skill 11-1 Recommend a DevSecOps process
289(5)
DevSecOps Controls
290(1)
Plan and develop
290(1)
Commit the code
291(1)
Build and test
292(1)
Go to production and operate
293(1)
Skill 11-2 Recommend a methodology for asset protection
294(3)
Getting secure
294(1)
Staying secure
294(1)
Key recommendations for an asset protection program
295(2)
Skill 11-3 Recommend strategies for managing and minimizing risk
297(2)
Measuring risk
298(1)
Managing security risk
298(1)
Thought experiment
299(1)
Using the CAF for secure methodologies at Tailwind Traders
299(1)
Thought experiment answers
300(1)
Chapter summary
301(2)
Chapter 12 Recommend a ransomware strategy by using Microsoft Security Best Practices
303(12)
Skill 12-1 Plan for ransomware protection and extortion-based attacks
303(3)
Preparation
304(1)
Security hygiene and damage control
305(1)
Skill 12-2 Protect assets from ransomware attacks
306(3)
Enter environment
307(2)
Traverse and spread
309(1)
Execute objective
309(1)
Skill 12-3 Recommend Microsoft ransomware best practices
309(3)
Best practices
310(2)
Thought experiment
312(1)
Developing a strategy to protect against ransomware
312(1)
Thought experiment answers
312(1)
Chapter summary
313(2)
Index 315
Yuri Diogenes, MSC Master of science in cybersecurity intelligence and forensics investigation from UTICA College, currently working on his PhD in Cybersecurity Leadership from Capitol Technology University. Yuri has been working at Microsoft since 2006, and currently he is a Principal PM Manager for the CxE Microsoft Defender for Cloud Team. Yuri has published a total of 29 books, mostly around information security and Microsoft technologies. Yuri is also a Professor at EC-Council University where he teaches at the Bachelor in Cybersecurity Program. Yuri also has an MBA and many IT/Security industry certifications, such as CISSP, MITRE ATT&CK® Cyber Threat Intelligence Certified, E|CND, E|CEH, E|CSA, E|CHFI, CompTIA Security+, CySA+, Network+, CASP and CyberSec First Responder. You can follow Yuri on Twitter at @ yuridiogenes.

Mark Simos is Lead Cybersecurity Architect for Microsoft where he leads the development of cybersecurity reference architectures, best practices, reference strategies, prescriptive roadmaps, CISO workshops, and other guidance to help organizations meet cybersecurity and digital transformation goals. Mark is co-host of the Azure Security Podcast and actively contributes to open standards and other publications such as the Zero Trust Commandments, The Open Group Zero Trust Core Principles, NIST Guide for Cybersecurity Event Recovery (800-184), NIST Guide to Enterprise Patch Management (800-40), Microsoft Digital Defense Report, and Microsoft Security blogs. Mark also co-chairs the Zero Trust Architecture (ZTA) working group at The Open Group and has presented numerous conferences including Black Hat USA, RSA Conference, Gartner Security & Risk Management, Microsoft BlueHat, Microsoft Ignite, and Financial Executives International.

Sarah Young is a Senior Cloud Security Advocate at Microsoft and a CNCF Ambassador with over a decade of experience in security across Europe, the US and Asia. Sarah is an experienced public speaker and has presented on a range of IT security and technology topics at industry events and holds numerous industry qualifications including CISSP, CCSP, CISM and Azure Solutions Architect and has previously co-authored Microsoft Press technical books. She is also a co-host of the Azure Security Podcast. Sarah has also won the Security Champion award at the Australian Women in Security Awards. She is an active supporter of both local and international security and cloud native communities. You can follow Sarah on Twitter @_sarahyo, although expect many dog pictures alongside security content.

Gladys Rodriguez is Principal Cybersecurity Engineer with over 25 years in the Information Technology field. As part of the Mission Engineering team, Gladys has helped embed existing security capabilities within Microsoft developed products/services. She has also helped create new security functionality for customers to enable zero trust in their environment. Recently, Gladys has been involved in helping develop zero trust strategies for Operational Technology used in Critical Infrastructure with special focus in aerospace solutions. Gladys is co-host of the Azure Security Podcast for both English and Spanish version. She has also contributed to publications such as the Microsoft Zero Trust publications, NIST SP 800-207, Zero Trust Architecture, Microsoft Exam SC-100: Microsoft Cybersecurity Architect and others. Gladys also spends a lot of time mentoring and sharing her knowledge with others to help them get more involved in the cybersecurity space.