CertifyDeckCargando contenido…
The official Microsoft Certified: Cybersecurity Architect Expert syllabus, organized by domain. Check off each point as you review it.
Inicia sesión para guardar tu progreso entre sesiones.
Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best Practices
Resiliency starts by identifying the assets whose compromise would hurt the business most and mapping them to IT assets, without delaying backup and privileged access work. Microsoft prioritizes recovery by category, with identity systems first, and the Zero Trust guidance bases breach preparation on a documented risk appetite and the breach scenarios you choose to address.
Backup and restore plan to protect against ransomware ↗Prevent or reduce business damage from a breach ↗
A BCDR design combines Azure Site Recovery, which replicates Azure, on-premises and AWS machines with orchestrated failover, and Azure Backup, whose data is isolated from production. To withstand attacks on backups, use soft delete, a locked immutable vault and multi-user authorization with a Resource Guard, ideally placed in another tenant.
Overview of security features in Azure Backup ↗About Site Recovery ↗
Microsoft orders ransomware mitigation into three steps: prepare a recovery plan with protected, immutable backups, limit the scope by protecting privileged access and, last, make entry harder. The privileged access phase includes sessions validated with Conditional Access, protecting identity systems, stopping lateral traversal with unique local passwords and rapid threat response.
Quickly protect your organization against ransomware attacks ↗Limit the impact of ransomware attacks ↗
When evaluating update solutions, separate the roles: Azure Update Manager assesses and patches Windows and Linux servers in Azure, on-premises and other clouds through Azure Arc; Windows Autopatch automates client device updates in rings; and Defender Vulnerability Management and Defender for Cloud prioritize and flag what still needs remediation.
What is Azure Update Manager? ↗What is Microsoft Defender Vulnerability Management ↗
Design solutions that align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB)
MCRA serves as a template to define the target state of cybersecurity capabilities across hybrid, multicloud and OT estates and to compare it with what is already owned. MCSB organizes controls by domain, with principle, risk, MITRE ATT&CK, criticality and mappings to NIST, CIS, PCI-DSS or ISO, which show full or partial coverage, not guaranteed compliance.
Microsoft Cybersecurity Reference Architectures ↗Overview of Microsoft cloud security benchmark v2 (preview) ↗
For insider threats, Microsoft Purview Insider Risk Management correlates signals, pseudonymizes users and escalates cases; for external threats, Defender External Attack Surface Management discovers unknown exposed assets. For the supply chain, MCSB calls for an SBOM, gating that blocks vulnerable components, Dependabot, CodeQL and no standing privileged access to pipelines.
Learn about Insider Risk Management ↗Security Control: DevOps security ↗
The MCSB AI security domain is organized into three pillars: platform (approved models enforced with Azure Policy), application (multi-layered content filtering, safety meta-prompts, least privilege for agents and human-in-the-loop for critical actions) and monitor and respond, with jailbreak detection in Defender for Cloud and continuous red teaming with tools such as PYRIT.
The Zero Trust adoption framework uses the Cloud Adoption Framework phases (define strategy, plan, ready, adopt, govern and manage) and five business scenarios with four implementation stages each. It scales in two dimensions, extending one piece across the estate and repeating with the next, and tracks progress with tools such as the Zero Trust initiative in Exposure Management.
Zero Trust adoption framework overview ↗Prevent or reduce business damage from a breach ↗
Design solutions that align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework
The Cloud Adoption Framework recommends discovering AI risks from the existing threat modeling framework, supplemented with MITRE ATLAS and OWASP, and repeating assessments periodically. Then inventory AI workloads, for example with AI security posture management in Defender for Cloud, protect them with managed identities, private networking and Purview DLP, and detect threats automatically.
Guidance to set up your organization's AI security process ↗Overview - AI security posture management ↗
The Cloud Adoption Framework Secure methodology applies security across every phase and maps controls to the CIA triad; governance relies on an empowered team, a RACI matrix and policies with an ID, statement, scope and remediation. The Well-Architected Framework adds Zero Trust driven design principles, such as replacing standing permissions with just-in-time access.
To recommend solutions, the Cloud Adoption Framework turns each governance policy into a control with its tool, such as Azure Policy for encryption or Entra ID Governance for access reviews. The Azure landing zone brings Defender for Cloud, Sentinel, Azure Firewall, PIM and policies such as blocking inbound RDP, and posture is sustained with secure score and automated drift detection.
An Azure landing zone separates a platform landing zone (usually one per tenant) from workload landing zones, which inherit the Azure Policy assignments made on the management group hierarchy. Team permissions are assigned at subscription or resource group scope, not on management groups, and the reference architecture includes Defender for Cloud, Microsoft Sentinel, Azure Firewall and PIM.
Security design in Azure - Cloud Adoption Framework ↗Management groups - Cloud Adoption Framework ↗
CAF calls for CI/CD pipelines with static analysis, vulnerability scanning and compliance checks, deploying all infrastructure as code, and protecting resources with deployment stacks and deny settings. DevOps security in Defender for Cloud centralizes findings from Azure DevOps, GitHub and GitLab, and OIDC federation avoids storing Azure credentials as secrets.
Perform Your Cloud Adoption Securely - Cloud Adoption Framework ↗Microsoft Defender for Cloud DevOps Security Benefits ↗