Microsoft AZ-500: Incident Response, Recovery and Resilience — Study Guide

By Laurynas Brazys · 11 August 2026 · #microsoft #az-500 #certification #exam-prep #study-guide

Part of the Microsoft Azure Security Engineer Associate AZ-500 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Incident response, recovery, and resilience in Azure are a continuous capability that blends well-rehearsed operational procedures with platform-native controls. An effective program anticipates failure or compromise, detects and triages quickly, contains blast radius with automation, restores service to defined objectives, preserves immutable evidence, and then hardens the environment based on what was learned. Azure-native services—Microsoft Sentinel, Defender for Cloud, Logic Apps, Azure Backup, Azure Site Recovery (ASR), DDoS Protection, Web Application Firewall (WAF), Traffic Manager/Front Door, and Microsoft Entra—provide the building blocks. The design imperative is to pre-stage the right telemetry, identity break-glass pathways, and automated enforcement so that teams can execute within minutes, not hours.

Incident response lifecycle and Sentinel operations

• Preparation

  • Define who does what, when, and with what tools. Pre-provision Microsoft Sentinel workspaces, connect data sources (Activity Log, resource logs, NSG flow logs, Microsoft Entra sign-in/audit logs, Defender signals), and implement access controls and RBAC for analysts, responders, and incident commanders.
  • Create playbooks (Logic Apps) for common containment actions such as VM isolation, user token revocation, or key rotation. Pre-stage quarantine NSGs and dedicated “forensics” subscriptions.
  • Establish immutable log retention via Diagnostic Settings to Log Analytics and to an Azure Storage account with immutability (WORM).

• Detection

  • In Sentinel, enable analytics rules for credential theft, rare sign-in patterns, suspicious process execution, key vault abuse, and data exfiltration. Augment with UEBA and fusion rules to correlate benign events into meaningful incidents. Calibrate rule thresholds and suppression to minimize alert fatigue.

• Containment

  • Execute pre-approved actions: quarantine NICs via NSG, disable compromised service principals, revoke Entra refresh tokens, rotate secrets, disable inbound public endpoints, or put WAF into prevention mode. Use Sentinel automation rules to route by severity, add tags, assign owners, and trigger playbooks.

• Eradication

  • Remove persistence (startup tasks, scheduled jobs, cloud-init scripts, malicious extensions), rotate credentials, redeploy golden images, and patch vulnerabilities flagged by Defender for Cloud. For identity-related incidents, require password resets and strengthen Conditional Access.

• Recovery

  • Restore from Azure Backup to clean VNets; fail over using ASR recovery plans; validate integrity and rehydrate secrets and configurations from known-good sources (IaC templates, Key Vault with soft delete/purge protection). Ensure RTO and RPO are met.

• Lessons learned

  • Conduct a blameless review. Update Sentinel rules and playbooks, Azure Policy assignments, baseline images, and runbooks. Codify remediations in IaC and enforce via management groups.

Sentinel triage, evidence collection, investigation, and case management

• Triage

  • Prioritize incidents by severity, asset criticality, and blast radius using entity enrichment (host, user, IP) and watchlists. Use incident grouping to reduce duplicates and timeline view to understand sequence.

• Evidence collection

  • Bookmark notable events, export raw logs to immutable storage, snapshot affected VM disks for offline analysis, and capture process trees via Defender for Endpoint integrations. Preserve chain-of-custody by storing hashes and limiting access to a forensics resource group.

• Investigation

  • Use investigation graphs and entity pages (user sign-in history, host process tree). Hunt with KQL across SigninLogs, AuditLogs, SecurityEvent, and AzureDiagnostics. Record findings, attach artifacts, and tag IOCs for future detection.

• Case management

  • Standardize statuses (New, Active, In Progress, Resolved), owners, and SLA timers. Integrate Sentinel with ITSM (ServiceNow/Azure DevOps) for ticketing and change control. Automation rules can auto-close known benign alerts or escalate specific tactics to Tier 2.

Automated containment and workflow orchestration

• Sentinel automation rules

  • Trigger on incident creation/update. Dynamically assign ownership, set severity, add tags (e.g., QuarantineCandidate), and invoke one or more playbooks. Rationale: move from detection to action within seconds, consistent with least-privilege and pre-approved playbooks.

• Logic Apps playbooks

  • Common actions: apply quarantine NSG to a VM NIC, disable a user, revoke tokens, block an IP in WAF, or open an ITSM ticket with full context. Use managed identities and Azure RBAC to scope each playbook’s permissions to the exact resource set.

• Defender for Cloud workflow automation

  • On recommendations or alerts (e.g., “Open RDP to Internet”), auto-trigger playbooks to remediate (tighten NSG rules), tag resources for follow-up, or notify owners. Rationale: close exposure rapidly, improving Secure Score and shrinking attacker dwell time.

Example: quarantine a VM NIC in seconds

# Create a high-priority deny-all inbound NSG rule and associate a quarantine NSG to the NIC
az network nsg rule create -g rg-prod -n QuarantineDenyAll --nsg-name nsg-quarantine \
  --priority 100 --access Deny --direction Inbound --protocol '*' --source-address-prefixes '*' \
  --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges '*'

az network nic update -g rg-prod -n vm1-nic --network-security-group nsg-quarantine

Token revocation for a compromised user

az rest --method POST \
  --uri "https://graph.microsoft.com/v1.0/users/user@contoso.com/revokeSignInSessions"

Backup, replication, RTO/RPO, and resilience

Azure Backup security

• Recovery Services vaults and Backup vaults

  • Use vaults per workload boundary and region. Enable soft delete to protect from accidental/malicious backup item deletion; set an appropriate retention window aligned to regulatory needs. Enable purge protection (where supported) to prevent irreversible deletions.

• Immutability

  • Configure vault immutability. Use unlocked mode during initial tuning, then switch to locked mode to prevent reduction of retention or policy tampering. Rationale: ensures backups are write-once and modification-proof, a key anti-ransomware control.

• Multi-user authorization (MUA)

  • Protect critical backup operations (e.g., stop protection with delete data, change vault settings) using Azure Backup Resource Guard in a separate subscription/resource group owned by a different team. Rationale: enforces separation-of-duties; attackers must compromise two identities in different scopes to destroy recoverability.

• Cross-region capabilities

  • For RSV using GRS, enable cross-region restore to recover even if the primary region is unavailable. Validate that cryptographic keys used by workloads are also resilient (Key Vault soft delete/purge protection and, if required, geo-redundant recovery planning).

Azure Site Recovery (ASR)

• Replication

  • Azure-to-Azure, VMware/Hyper-V-to-Azure, and physical servers. Define replication policies (RPO threshold, recovery point retention, app-consistent snapshot frequency). Deploy Mobility service where required.

• Recovery plans

  • Orchestrate multi-tier app failover with boot order, manual steps, and runbooks (e.g., DNS updates, connection string flips). Keep credentials and scripts in Key Vault.

• Test failover

  • Perform regular, non-disruptive tests into an isolated VNet with masked IPs. Use “Cleanup test failover” to reset state. Rationale: validates end-to-end recovery without impacting production.

• Failback

  • After primary site recovery, reprotect and fail back, resynchronizing changes. Plan for bandwidth windows and maintenance to meet business SLAs.

Selecting architecture to meet RTO/RPO

• Tight RPO (seconds to minutes) and low RTO (minutes)

  • Prefer ASR or native application replication (e.g., SQL Always On, Cosmos DB multi-region) over backups; keep hot or warm standby; use Front Door/Traffic Manager for regional failover.

• Moderate RPO (hours) and RTO (hours)

  • Combine frequent backups with ASR for critical tiers; use backup acceleration features (instant restore snapshots) to reduce restore time.

• Long RPO (days) and RTO (days)

  • Backup-only with longer retention; cost-optimized archive tiers.

Operational reasoning: replication delivers small RPO at higher ongoing cost; backups deliver cheaper long-term retention but slower RTO/RPO. Mix per tier to match business impact analysis.

Network defense, forensics, continuity, and hardening

Azure DDoS response, WAF tuning, and traffic-management failover

• DDoS Protection Standard

  • Associate with VNets hosting public IPs. It provides adaptive real-time mitigation and DDoS Rapid Response (DRR) support during attacks. Configure alerts and diagnostics to Sentinel. Rationale: automatic mitigation at the edge before traffic reaches workloads.

• WAF tuning

  • Use managed OWASP rule sets and shift to prevention mode. Add exclusions for known benign patterns, turn on request size/body inspection where needed, and create custom rules for allow/deny and rate limiting on abusive IPs or geographies. Continuously refine based on logs.

• Traffic failover

  • Use Traffic Manager (DNS-based) with priority routing and low TTL for region failover, or Azure Front Door (anycast L7) for faster health-probe-driven failover and global ingress. Probe critical endpoints and perform regular failover drills.

Forensics: logs and immutable retention

• Activity Log

  • Audit control-plane actions (create/delete/role assignments). Stream to Sentinel and to Azure Storage with immutability for legal hold.

• Resource logs

  • Enable via Diagnostic Settings for key services (Key Vault, App Service, Storage, SQL, AKS). Route to Log Analytics, Event Hub, and immutable Storage.

• NSG flow logs

  • Enable in Network Watcher; analyze with Traffic Analytics to reconstruct network flows during incidents.

• Microsoft Entra sign-in and audit logs

  • Ingest into Sentinel for identity investigations. Monitor risky sign-ins and conditional access outcomes. Extend retention via Log Analytics archive and/or export to immutable Storage.

Break-glass and continuity controls

• Maintain at least two cloud-only Global Administrator break-glass accounts with long, complex passwords, excluded from Conditional Access and MFA policies to survive outages. Store credentials securely offline and monitor any sign-in with real-time alerts. Assign limited standing roles elsewhere; use PIM for just-in-time elevation during normal operations.
• Document emergency access procedures, including Entra “Elevate access to manage all Azure subscriptions” and steps to assign Owner at the root management group if RBAC is broken.
• Protect critical assets with management locks (CanNotDelete) and restrict role assignment scope using management groups.

Post-incident hardening

• Apply Azure Policy at management groups to enforce baseline (e.g., DeployIfNotExists for antimalware extensions, disk encryption, diagnostic settings, JIT VM access). Remediate noncompliance with policy remediation tasks.
• Improve detection by tuning Sentinel analytics (add new IOCs, adjust thresholds), converting successful hunts into scheduled rules, and adding automation rules to triage.
• Update security baselines (images, Key Vault policies, NSG/WAF rules). Capture all changes as code (Bicep/Terraform) and validate with CI/CD and change control. Track Secure Score and regulatory compliance to measure progress.

Practical Problem Scenario

Starbucks experiences a surge of suspicious sign-ins followed by anomalous storage egress from a production subscription hosting an order API. The security team must contain, investigate, and restore service while preserving evidence and meeting a two-hour RTO and 15-minute RPO for the API tier.

1. Automate triage and contain the blast radius

• In Sentinel, an automation rule triggers on high-severity incidents with entities from the order API resource group, assigns the on-call analyst, tags the incident QuarantineCandidate, and runs a playbook to:
  • Revoke sessions for the compromised user.
  • Apply a quarantine NSG to the API VM scale set NICs.
  • Add a WAF custom rule to block the offending IP ranges.
• Rationale: Automation executes pre-approved, least-privilege actions within seconds, shrinking attacker dwell time and preventing further data egress.

2. Preserve evidence with immutability

• The playbook snapshots affected VM OS/data disks and exports Activity Log, NSG flow logs, and Storage account logs for the target containers to an Azure Storage account with time-based immutability and legal hold. Bookmarks and KQL queries are attached to the Sentinel incident.
• Rationale: Immutable storage ensures chain-of-custody; snapshots enable offline forensics without altering the compromised systems.

3. Recover service to RTO/RPO

• Because the API tier is protected by ASR with a 15-minute app-consistent snapshot frequency, the team executes a prioritized recovery plan to fail over the API tier to the paired region. Azure Front Door performs health-probe-based failover to the secondary endpoint.
• Rationale: Replication meets the 15-minute RPO, and orchestrated failover plus Front Door routing meets the two-hour RTO without restoring from backup.

4. Remediate identity and secrets

• Privileged admins rotate credentials and keys in Key Vault (with soft delete and purge protection enabled) and disable the compromised account, enforcing stronger Conditional Access for privileged roles.
• Rationale: Secrets and identity are common persistence vectors; rapid rotation and stricter access controls cut off attacker reentry.

5. Post-incident hardening and validation

• The team tunes WAF managed rules, adds a rate-limiting custom rule, onboards the Storage account to Defender for Cloud with anomaly alerts, and deploys Azure Policy to enforce diagnostic settings and NSG baselines by default. A Sentinel analytics rule is added to detect similar egress patterns, and a drill is scheduled to validate ASR recovery plans quarterly.
• Rationale: Institutionalizing fixes via policy and analytics reduces recurrence and ensures resilience remains verifiable and repeatable.

← Hybrid and Multi-Cloud Security · All domains

Practice these questions → · Timed practice on ExamRoll.io →

Browse Microsoft →