What's changed: Added per-section figures (cert-figure-retrofit). New SC-500 Chapter 3 (Domain 3 "Secure compute": AI security = SharePoint overexposure/Purview DSPM for AI/Copilot Studio real-time protection/Entra Agent ID-conditional access/Defender XDR blast radius/APIM AI Gateway-Foundry guardrails/Defender for AI-Data and AI dashboard; servers/VMs = Bastion-JIT/disk encryption-trusted launch/Defender for Servers-agentless/Azure Arc/Machine Configuration; app platform = Defender for Containers/ACR-AKS/App Service-Functions-Logic Apps/WAF-API Management)
3.3Securing application platform services
Learn protecting container workloads (Defender for Containers), security controls for AKS, Azure Container Registry, and Container Instances/Apps, securing Azure Functions, Logic Apps, and App Service, Web Application Firewall, and back-end API protection with API Management.
PaaS and container platforms speed development but their misconfigurations and broad exposure often become vulnerabilities. The angles: protect container config and runtime (Defender for Containers) → control the registry/orchestrator (ACR/AKS) → protect app runtimes (App Service/Functions/Logic Apps) → defend the public boundary (WAF/APIM).
3.3.1Protecting containers: Defender for Containers, AKS, ACR
Microsoft Defender for Containers detects misconfigurations (configuration weaknesses) and runtime risks (suspicious processes, known exploits, etc.) in container workloads. Store images in Azure Container Registry (ACR) and protect with vulnerability scanning and allowing only trusted images. The orchestrator Azure Kubernetes Service (AKS) controls access and traffic via Entra integration, RBAC, network policies, and private clusters. Lightweight Azure Container Instances (ACI)/Container Apps are also secured with network and identity controls.
3.3.2App runtimes: App Service, Functions, Logic Apps
App Service, Azure Functions, and Logic Apps control access with authentication (App Service authentication/Easy Auth, Entra ID) and narrow reachability with network restriction (access restriction rules, private endpoints, VNet integration). For Functions, mind trigger/binding permissions; for Logic Apps, mind connector credentials (prefer managed identity). Externalize secrets via Key Vault references.
3.3.3Defending the public boundary: WAF and API Management
Public web apps/APIs are protected by Azure Web Application Firewall (WAF) (integrated with Application Gateway or Front Door) against common OWASP attacks like SQL injection and XSS. API Management (APIM) is central to back-end API protection, applying policies—subscription key/OAuth validation, rate limiting, IP restriction, JWT validation—centrally at the gateway so backends are never exposed directly (the AI Gateway in §s1 is also an APIM capability).
| Target | Main control | Key point |
|---|---|---|
| Containers in general | Defender for Containers | Detect misconfig + runtime risk |
| Images | ACR (vuln scanning/trusted images) | Allow only trusted images |
| Orchestrator | AKS (Entra/RBAC/network policy/private) | Control access and traffic |
| App runtimes | App Service/Functions/Logic Apps (auth + network + managed identity) | Externalize secrets via Key Vault references |
| Public web/API | WAF + API Management | OWASP protection + gateway-level API protection |
Watch the mix-ups: (1) WAF (blocks L7 web attacks = OWASP) vs API Management (applies API access control, rate limiting, JWT validation at the gateway)—different roles, often combined. (2) Defender for Containers (config + runtime threat detection) vs ACR vulnerability scanning (known image vulns). (3) app authentication (who) vs network restriction (from where) are separate layers.
Map requirement → feature: "protect a public app from OWASP web attacks" = WAF; "rate-limit/validate JWT without exposing the backend API" = API Management; "detect container misconfig and runtime risk" = Defender for Containers; "scan image vulnerabilities and allow only trusted images" = ACR; "avoid secrets for Logic Apps connections" = managed identity.
3.3.4Section summary
- Containers: Defender for Containers (config + runtime) + ACR (image vuln/trust) + AKS (Entra/RBAC/network/private)
- App runtimes: authentication (Easy Auth/Entra) + network restriction + managed identity + Key Vault references
- Public boundary: WAF (OWASP) + API Management (gateway-level API protection)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which Defender for Cloud plan detects misconfigurations and runtime risks (suspicious processes, known exploits) in container workloads?
Q2. Which protects a public web application from common OWASP attacks such as SQL injection and XSS?
Q3. Which applies policies like rate limiting, JWT validation, and subscription keys centrally at a gateway so the backend API is not exposed directly?
Q4. Which registry scans container images for known vulnerabilities and allows only trusted images?
Q5. For Logic Apps or Functions connecting to other services, what is the recommended way to authenticate without secrets in code/config?
Q6. Which statement about WAF and API Management is correct?