What's changed: Added per-section figures (cert-figure-retrofit). New SC-500 Chapter 2 (Domain 2 "Secure storage, databases, and networking": storage = firewall/private endpoint/Entra authorization-SAS/Defender for Storage; Azure SQL = Entra auth/auditing/TDE-Always Encrypted/Defender for Databases; networking = NSG-ASG/Virtual Network Manager/Virtual WAN-VPN/Entra Private Access/private endpoint-Private Link; Azure Firewall = application/network/DNAT rules, threat intel/IDPS, Firewall Policy/Network Watcher diagnostics)
2.1Securing storage and databases
Learn storage account security (firewall rules, access policies, Defender for Storage) and platform-level security for Azure SQL (authentication, networking, auditing, Defender for Databases) through the lens of layered data protection.
Because data is often the attacker’s ultimate goal, protecting storage and databases is the heaviest part of this domain (25–30%). The pattern is layered defense: narrow by network → narrow by identity/access → encrypt → detect threats. This section maps each layer to concrete features using Azure Storage and Azure SQL.
2.1.1Storage account network and access control
Storage accounts are publicly reachable by default. A storage firewall restricts to "selected virtual networks / IPs," and a private endpoint confines access to a private IP in the VNet. For access control, prefer Microsoft Entra authorization (RBAC) over shared keys; for temporary delegation use a SAS (Shared Access Signature) that is least-privilege, short-lived, and ideally a user delegation SAS (Entra-based). Disable anonymous/public blob access by default.
2.1.2Threat detection with Defender for Storage
Microsoft Defender for Storage is a threat-protection plan that detects suspicious access and uploads to storage. It offers malware scanning (scans uploaded blobs for malicious files) and sensitive data threat detection (alerts on anomalous access to blobs containing sensitive data). Unlike CSPM, which checks configuration quality, this is runtime threat detection (workload protection).
2.1.3Azure SQL platform security and auditing
For Azure SQL Database / Managed Instance, prefer Microsoft Entra authentication (central, MFA-capable) over passwords, and narrow the network with private endpoints or firewall rules. SQL auditing records database operations to Log Analytics or storage for investigation and evidence. Threat detection is provided by Microsoft Defender for Databases (formerly Advanced Threat Protection), alerting on suspected SQL injection, anomalous logins, and unusual access to sensitive data. Data at rest is encrypted by Transparent Data Encryption (TDE), and column-level protection uses Always Encrypted.
| Layer | Storage | Azure SQL |
|---|---|---|
| Network | Storage firewall / private endpoint | Firewall rules / private endpoint |
| Identity/access | Prefer Entra (RBAC); least/short SAS; disable anonymous | Prefer Entra auth; least privilege |
| Encryption | Encryption at rest (default); CMK optional | TDE (at rest); Always Encrypted (column-level) |
| Auditing | Diagnostic settings / storage analytics | SQL auditing → Log Analytics/storage |
| Threat detection | Defender for Storage (malware/sensitive data) | Defender for Databases (SQLi/anomalous logins) |
Watch the mix-ups: (1) prefer Entra authorization (RBAC) over shared/account keys (full power, must rotate); for temporary delegation use a SAS (least, short-lived, user delegation SAS). (2) TDE (whole-database at-rest encryption) vs Always Encrypted (specific columns encrypted client-side). (3) Defender for Storage/Databases (runtime threat detection) vs Defender CSPM (configuration posture).
Map requirement → feature: "detect malware in uploaded blobs" = Defender for Storage malware scanning; "detect SQL injection / anomalous logins" = Defender for Databases; "limit storage access to the VNet" = private endpoint; "encrypt specific DB columns client-side" = Always Encrypted; "temporarily share a blob with least privilege" = user delegation SAS.
2.1.4Section summary
- Data protection is layered: network → identity/access → encryption → threat detection
- Storage: firewall/private endpoint + Entra authorization (least/short SAS) + Defender for Storage
- Azure SQL: Entra auth + private endpoint + SQL auditing + TDE/Always Encrypted + Defender for Databases
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which threat-protection plan scans uploaded blobs in a storage account to detect malware?
Q2. For storage access, which authorization should be preferred over shared keys?
Q3. Which mechanism encrypts an Azure SQL database at rest by default?
Q4. Which detects suspected SQL injection and anomalous logins on Azure SQL and raises alerts?
Q5. Which feature encrypts specific database columns (e.g., credit card numbers) client-side so even DB admins cannot see plaintext?
Q6. Which limits network access to a storage account to a private IP within a virtual network only?