Practice Azure security, Microsoft Entra ID, Zero Trust, KQL, detection engineering and incident response in one synthetic environment — without deploying paid cloud resources.
Original local question banks for AZ-900 and SC-900. Training threshold: 80% — a project setting, not Microsoft's official scoring model.
Review Azure RBAC and Microsoft Entra role assignments, identify unnecessary privilege and document the recommended response.
Correlate location, device, MFA, risk and sign-in outcome. Assume breach, verify explicitly and contain only after evidence supports the decision.
Build and run KQL against synthetic SigninLogs, AuditLogs and AzureActivity. Save rules, generate alerts and explain the query pipeline.
Turn detection hits into structured investigations. Review evidence, document analyst notes, contain sessions and close incidents.
Review synthetic Azure resource configurations, prioritize findings and improve the local Secure Score through remediation.
Inspect a segmented VNet design, review NSG intent and run a local static security scan. Nothing is deployed.
Turn completed investigations into concise evidence of your security thinking: signal → analysis → decision → response.