WELCOME

Azure Data Concepts Overview The diagram shows how day-to-day business transactions become data for reporting and analysis, and where three common data roles contribute. OLTP versus OLAP OLTP and OLAP describe workload patterns, rather than two exclusive categories of database products. A database platform can support both, although systems are often optimized for one. Characteristic OLTP — Online Transaction Processing OLAP — Online Analytical Processing Purpose Run business

AZ-104 Azure Virtual Machines: Review 1. You are creating an Azure VM. Which resource connects the VM to a subnet in an Azure virtual network? A. Network interface B. Availability set C. Recovery Services vault D. Disk encryption set 2. A VM requires secure administrative access through the Azure portal without assigning a public IP address to the VM. Which service should you consider? A. Azure Traffic Manager B. Azure Bastion C. Azure NAT Gateway D. Azure DNS 3. Which VM fam

Deploy and Manage Azure Compute Resources — 20–25% Create and configure virtual machines Create a virtual machine Configure Azure Disk Encryption Move a virtual machine to another resource group, subscription, or region Manage virtual machine sizes Manage virtual machine disks Deploy virtual machines to availability zones and availability sets Deploy and configure an Azure Virtual Machine Scale Sets Virtual machine cost controls Azure VM reliability settings Azure VM security

AZ-104: Microsoft Azure Administrator — Exam Skills Checklist Use this as a self-assessment tracker. For each bullet, rate yourself: ✅ confident ⚠️ shaky ❌ haven't touched it 1. Manage Azure Identities and Governance — 20–25% Manage Microsoft Entra users and groups Create users and groups Manage user and group properties Manage licenses in Microsoft Entra ID Manage external users Configure self-service password reset (SSPR) Manage access to Azure resources Manage built-in Azu

Configure and manage virtual networks in Azure — 12 questions 1. You create a VNet with address space 10.0.0.0/16. Which pair of subnet ranges is valid and non-overlapping? A. 10.0.1.0/24 and 10.0.1.128/25 B. 10.0.1.0/24 and 10.0.2.0/24 C. 10.0.1.0/24 and 10.1.2.0/24 D. 10.0.0.0/16 and 10.0.2.0/24 2. How many IPv4 addresses are assignable to resources in a typical Azure /24 subnet after Azure’s reserved addresses are excluded? A. 254 B. 256 C. 250 D. 251 3. A VM requires two

Implement and Manage Virtual Networking — 15–20% of exam Configure and manage virtual networks in Azure Create and configure virtual networks and subnets Create and configure virtual network peering Configure public IP addresses Configure user-defined routes Other Azure Network Topics (Express Route) Azure Virtual WAN File share settings, configure identity-based access for storage Azure network performance Optimizations and Redundancy Troubleshoot network connectivity NSG an

The template has 31 subsections and 165 sub-subsection items across its nine major sections. Major section Subsections Sub-subsection items 1. Executive Summary and Strategic Intent 2 17 2. Governance, Scope, and Accountability 4 19 3. CEM and THIRF Strategic Outcomes 3 14 4. Baseline Logging Strategy and Coverage Posture 4 14 5. Mission/Risk-Based Prioritization 3 17 6. Enterprise Logging and Data Strategy 4 17 7. Security, Privacy, Integrity, and Resilience 4 17 8. Validati

Exam domain: Implement and Manage Storage (15–20%) This module covers Azure Storage fundamentals, configuration, access control, data protection, and administration. The core configuration sections align with Microsoft’s current AZ-104 storage objectives; service selection, cost optimization, cybersecurity, and labs provide supporting practical knowledge. 1. Azure Storage Fundamentals Overview of Azure Storage services and storage accounts Introduction to Blob Storage, Azure

1. Section 1 — Azure Storage Fundamentals Which Azure Storage service is designed to store application messages for asynchronous processing? A. Azure Files B. Azure Queue Storage C. Azure Blob Storage D. Azure Table Storage 2. Section 2 — Choosing the Right Storage Solution An organization needs to store frequently accessed documents and provide full-text search across their contents. Which solution best meets this requirement? A. Azure Files with share snapshots B. Blob Stor

Writing a Detection: Overview The core of a detection is its analytic logic: the conditions used to evaluate organizational telemetry and identify activity that may be malicious, suspicious, or inconsistent with expected behavior. Detection logic may use one or more analytic methods, including: Matching a specific string, command, file path, event ID, or field value Combining multiple strings, fields, events, or log sources Correlating related activity across identities, endp

Detection Engineering Design Philosophies At this point in the course, it is useful to take a quick beyond the detection development process and go beyond detection engineering form and process. It is critical to examine the underlying philosophies that make detections more effective, resilient, and operationally valuable. Some detection design requirements are straightforward. As discussed previously, frameworks such as Palantir’s Alerting and Detection Strategy (ADS) estab

Detection Engineering Program: High-Level Frameworks As detection engineering has matured, practitioners have developed frameworks to make detection programs more structured, consistent, and measurable. One of the earliest influential models was Palantir’s Alerting and Detection Strategy (ADS) Framework, introduced nearly a decade ago and subsequently refined. The Problem: Inconsistent Detection Practices Historically, many organizations developed custom detections without a

What detections do I create? A simple answer to this question is, create detections for things you don't have detections for! the harder part of answering this main question is two fudnnamteal questions that udnerpoin it: what do I have detections for? What do I detcetions do I need? Threat Analysis and Identifying Detection Gaps Support Incident response Cyber Threat Intelligence Threats Exposure Gaps & Cyber Threat Intelligence Threat Hunt Missions Five reasons for creating

!!!Note: this is learning Notes, some AI slop. KQL needs to be tested!!! Detecting Microsoft CoPilot Abuse Patterns Because most of these techniques abuse legitimate Copilot functionality rather than exploiting a classic software vulnerability, detection has to shift from "block the bad traffic" to "baseline normal Copilot behavior and flag deviation. Purview / Copilot audit log analysis Monitor for Copilot interactions that retrieve sensitive-labeled content (per Microsoft P

Brief Overview of How Microsoft 365 Copilot Works Microsoft Copilot is an AI-powered processing and orchestration engine that combines several Microsoft technologies to deliver contextual productivity assistance. At a high level, Copilot coordinates three key components: Large Language Models (LLMs) — provide the AI reasoning and natural-language processing capabilities. Microsoft Graph — provides access to organizational context, including emails, chats, documents, meetings,

How Abuse of Microsoft Copilot Maps to the Attack Matrices MITRE ATLAS (atlas.mitre.org) Mitre Atlas is the ATT&CK-style knowledge base purpose-built for adversarial tactics against AI/ML systems. As of the current release it organizes techniques into 16 tactics run in rough attack-progression order: Reconnaissance → Resource Development → Initial Access → AI Model Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lat

Scheduled Tasks Overview and Impact to Cybersecurity Running scheduled tasks is a fundamental part of Windows system administration. Organizations routinely use scheduled tasks to automate activities that need to occur at specific times or in response to specific system events. Common examples include running scripts, performing system maintenance, checking system health, generating reports, cleaning up temporary files, and executing backup or update routines. However, like m

Palantir Technologies — Overview Palantir is a data-analytics and AI software company founded in 2003, originally built for U.S. intelligence and counterterrorism work before expanding into commercial enterprise markets. Its core pitch: help large, complex organizations integrate messy, siloed data and turn it into operational decisions, not just dashboards, but software that can trigger real-world actions. Palantir organizes its offering around four principal software platfo

KQL Numeric and Comparison Operators KQL provides a standard set of arithmetic and comparison operators used for calculations and filtering: Arithmetic Operators (return numeric values) + Addition - Subtraction * Multiplication / Division % Modulo (remainder) These are commonly used for: Rate calculations (e.g., bytes/sec) Data normalization Threshold comparisons Comparison & Membership Operators (return boolean values) > Greater than < Less than >= Greater tha

KQL Essentials: Variables with let and Arrays with dynamic Kusto Query Language (KQL) supports variables using the let statement, which allows you to store values, expressions, or entire subqueries for reuse within a query. This enhances readability, reduces duplication, and improves maintainability of complex queries. Using let to Create Variables The let statement follows this basic format: let VariableName = ExpressionOrValue; Key Components of let statement: let – Keyword