Cloud and AI Security Engineer Associate Certification SC-500

• Secure access to resources using Microsoft Entra ID and Azure Key Vault.
• Enforce security and regulatory compliance.
• Secure storage, databases, and networking.
• Secure compute and AI solutions.
• Manage and monitor security posture.
• Work with Microsoft Defender for Cloud, Microsoft Sentinel, and Microsoft Security Copilot.

Module 1: Secure access to resources by using Microsoft Entra

• Implement and configure Privileged Identity Management (PIM)
• Implement conditional access policies
• Implement and configure authentication methods, including multifactor authentication (MFA) and passwordless
• Implement and configure identity for applications, including enterprise applications and app registrations
• Manage OAuth permission grants and consent settings
• Implement and configure managed identities for Azure resources

Module 2: Secure Azure Key Vault with defense in depth for the cloud and AI workloads

• Deploy Key Vault
• Configure Key Vault settings
• Configure access to Key Vault
• Configure firewall settings on Key Vault
• Manage keys, secrets, and certificates
• Scan for secrets by using Defender Cloud Security Posture Management (Defender CSPM)
• Implement Defender for Key Vault

Module 3: Enforce security governance and regulatory compliance

• Implement and configure security controls by using Azure Policy
• Evaluate regulatory compliance by using Microsoft Defender for Cloud
• Implement and configure security controls in Defender for Cloud
• Implement resource locks
• Manage Azure built-in role assignments
• Manage custom roles, including Azure roles and Microsoft Entra roles
• Evaluate and remediate overprivileged access assignments by using Azure role-based access control (RBAC)
• Configure security controls for backup protection by using Azure Backup security features
• Implement and configure security controls by using infrastructure as code

Module 4: Implement security for Azure Storage for the cloud and AI security engineer

• Implement and configure security for storage accounts
• Configure Azure Storage firewall rules
• Implement Defender for Storage threat protection configurations
• Manage access to storage, including access policies

Module 5: Implement security for Azure databases

• Implement platform-level security configurations in Azure SQL
• Configure database auditing for Azure SQL Database and Azure SQL Managed Instance
• Configure Defender for Databases protection across Azure database services

Module 6: Implement security for Azure network services

• Implement and manage network security groups (NSGs) and application security groups (ASGs)
• Implement and configure network access policies by using Azure Virtual Network Manager
• Configure security for an Azure Virtual WAN
• Implement and configure security for virtual private network (VPN) connections
• Implement and configure Microsoft Entra Private Access
• Configure Azure private endpoints to secure access to Azure platform as a service (PaaS) resources
• Configure Azure Private Link services to secure access to network resources
• Implement and configure Azure Firewall
• Evaluate effective security rules by using Azure Network Watcher diagnostics

Module 7: Implement security for AI

• Identify overexposure of data in SharePoint
• Identify risks related to Microsoft Copilot and AI apps by using Microsoft Purview Data Security Posture Management (DSPM)
• Enable and configure real-time protection for Microsoft Copilot Studio agents
• Implement conditional access for Microsoft Entra Agent ID
• Analyze blast radius for security risks related to Microsoft Entra Agent ID by using Defender XDR
• Manage Microsoft Entra Agent ID access
• Configure and deploy AI Gateway in Azure API Management for Microsoft Foundry
• Enable Defender for AI Service in Cloud Workload Protection in Defender for Cloud
• Configure guardrails for agent security in Foundry
• Monitor AI security by using the Data and AI security dashboard in Defender for Cloud
• Manage agents in Microsoft 365 admin center

Module 8: Implement security for servers and virtual machines (VMs)

• Implement and configure disk encryption
• Plan and implement Azure Bastion
• Enable and enforce use of just-in-time (JIT) VM access
• Extend security controls to hybrid and multicloud servers by using Azure Arc
• Onboard servers to Defender for Servers in Defender for Cloud
• Configure Defender for Servers settings, including vulnerability scanning and endpoint detection and response (EDR)
• Implement and manage agentless scanning for VMs in Defender for Servers
• Configure security features on a VM, including secure boot, virtual Trusted Platform Module (vTPM), integrity monitoring, and security type
• Enforce security configuration of Azure-managed servers by using Azure Machine Configuration

Module 9: Implement security for application platform services

• Detect misconfigurations and runtime risks in container workloads by using Defender for Containers
• Implement and configure security controls for Azure Kubernetes Service (AKS)
• Implement and configure security controls for Azure Container Registry
• Implement and configure security controls for Azure Container Instances and Azure Container Apps
• Implement and configure security controls for Azure Functions, including authentication and network access
• Implement and configure security controls for Azure Logic Apps
• Implement and configure security controls for Azure App Service
• Implement and configure Azure Web Application Firewall
• Implement security policies for back-end API protection by using API Management

Module 10: Manage security posture by using Defender for Cloud

• Identify security risks by using Defender CSPM
• Evaluate compliance against security frameworks by using Defender for Cloud
• Enable and configure Defender for Cloud workload protection plans
• Connect hybrid cloud and multicloud environments to Defender for Cloud, including Amazon Web Services (AWS) and Google Cloud Platform (GCP)
• Configure Microsoft Defender Vulnerability Management settings for Azure VMs
• Discover unprotected assets and vulnerabilities by using Microsoft Defender External Attack Surface Management (EASM)

Module 11: Implement activity and event collection in Microsoft Sentinel

• Create and connect workspaces in Microsoft Sentinel
• Assign roles in Microsoft Sentinel
• Implement and use Content Hub solutions
• Configure and use Microsoft data connectors for Azure resources
• Implement and configure Syslog and Common Event Format (CEF) event collections
• Implement and configure collection of Windows Security events by using data collection rules, including Windows Event Forwarding (WEF)
• Create custom log tables in the workspace to store ingested data
• Implement automation rules and playbooks in Microsoft Sentinel
• Implement data retention in Microsoft Sentinel data stores
• Query Microsoft Purview Audit in Defender XDR

Module 12: Implement Microsoft Security Copilot

• Configure workspaces for Security Copilot
• Manage permissions and roles in Security Copilot
• Enable and configure plugins
• Enable and configure Microsoft agents and Security Store agents

4 Days

Certification: Microsoft Certified: Cloud and AI Security Engineer Associate
Exam: SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads
Duration: 100 minutes

• Configuring Microsoft Entra ID security controls
• Implementing Privileged Identity Management and Conditional Access
• Configuring Azure Key Vault, access controls, keys, secrets, and certificates
• Implementing Azure Policy and Defender for Cloud security controls
• Securing Azure Storage and Azure SQL
• Configuring NSGs, private endpoints, Private Link, VPN, and Azure Firewall
• Securing AI workloads, Copilot, agents, and Microsoft Foundry environments
• Securing Azure VMs and servers with Defender for Servers
• Securing AKS, containers, App Service, Functions, and other application platforms
• Managing security posture with Defender for Cloud
• Configuring Microsoft Sentinel workspaces, data connectors, automation rules, and playbooks
• Configuring Microsoft Security Copilot workspaces, permissions, plugins, and agents

• Security engineers responsible for protecting organizational systems and data across cloud and hybrid environments.
• Security professionals working across identity, network, application, data, and compute security.
• Professionals responsible for securing AI workloads.
• Security engineers working with Microsoft Azure and Microsoft 365.
• Professionals working with architects, administrators, engineers, analysts, and developers across security and cloud environments.

• Practical experience in administration of Microsoft Azure and hybrid environments, including compute, network, and storage.
• Strong familiarity with Microsoft Entra ID.
• Familiarity with Microsoft 365 administration.