{"id":33,"date":"2024-06-06T19:30:45","date_gmt":"2024-06-06T19:30:45","guid":{"rendered":"https:\/\/cyberstec.com\/?p=33"},"modified":"2025-05-05T16:45:42","modified_gmt":"2025-05-05T16:45:42","slug":"microsoft-cybersecurity-analyst-professional-certificate-and-capstone-project","status":"publish","type":"post","link":"https:\/\/cyberstec.com\/index.php\/2024\/06\/06\/microsoft-cybersecurity-analyst-professional-certificate-and-capstone-project\/","title":{"rendered":"Microsoft Cybersecurity Analyst Professional Certificate and Capstone Project"},"content":{"rendered":"\n<p>Having just completed this certification, I wanted to reflect on my experience and discuss the capstone project that was required to complete the course (that and the SC-900 mock exam, which I thought would be optional, but it wasn&#8217;t). Beyond being a review for myself of what I have learned, I hope this can be useful for someone considering taking this course, and perhaps for employers to help evaluate the course.<\/p>\n\n\n\n<p>I have no intention of taking the exam as this course covers cybersecurity fundamentals. My next step, after taking a short break to absorb all the knowledge acquired and practice some of the skills gained, is taking more advanced courses and gaining further qualifications in cloud computing security.<\/p>\n\n\n\n<p>That being said, the mock exam was still very useful to confirm I had understood all the topics covered in this course. The course itself has 9 modules, and it is fairly comprehensive, covering cybersecurity concepts from fundamentals of networking and cloud to treath vectors and mitigations, vulnerability management, defense in depth and the various tools, software and frameworks involved in designing and maintaining a secure network.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Computers and Operating Systems: overview of threat landscape, hardware components, Operating systems, various computing environments and fundamental cybersecurity principles.<\/li>\n\n\n\n<li>Introduction to Networking and Cloud Computing: cloud technologies and migration to the cloud or hybrid setup.<\/li>\n\n\n\n<li>Cybersecurity Threat Vectors and Mitigation: assessing potential threats and mitigation strategies.<\/li>\n\n\n\n<li>Cybersecurity Identity and Access Solutions: on Azure AD, identity and access policies, MFA, conditional access, RBAC and identity governance.<\/li>\n\n\n\n<li>Cybersecurity Solutions and Microsoft Defender: setting up and securing virtual machines, Azure Bastion, Azure Standard Firewall and Azure Sentinel.<\/li>\n\n\n\n<li>Cybersecurity Tools and Technologies: testing strategies, White box, grey box and black box testing.<\/li>\n\n\n\n<li>Cybersecurity Management and Compliance: compliance strategy. Regulations (GDPR, PCI_DSS, HIPAA, Sarbanes-Oxley&#8230;)<\/li>\n\n\n\n<li>Advanced Cybersecurity Concepts: threat modeling, penetration testing, IoT security.<\/li>\n\n\n\n<li>Mock exam and Capstone Project<\/li>\n<\/ol>\n\n\n\n<p>Overall, this is the list of the topics covered:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OSI MODEL<\/li>\n\n\n\n<li>REMOTE ACCESS<\/li>\n\n\n\n<li>DEFENSE IN DEPTH<\/li>\n\n\n\n<li>ZERO TRUST MODEL<\/li>\n\n\n\n<li>X as a service<\/li>\n\n\n\n<li>ENCRYPTION TOOLS AND CRYPTOGRAPHICS TECHNIQUES<\/li>\n\n\n\n<li>DATA MAPPING AND GOVERNANCE<\/li>\n\n\n\n<li>POLICIES<\/li>\n\n\n\n<li>INCIDENT RESPONSE AND REMEDIATION, BUSINESS CONTINUITY<\/li>\n\n\n\n<li>INSIDER RISK MANAGEMENT<\/li>\n\n\n\n<li>NETWORK TOPOLOGY AND ARCHITECTURE: VNETS, FIREWALLS, IDPS, NSGs<\/li>\n\n\n\n<li>IAM and RBAC (Role-based access control)<\/li>\n\n\n\n<li>AUDITING AND MONITORING (SIEM AND SOAR, LOGS)<\/li>\n\n\n\n<li>PENETRATION TESTING AND VULNERABILITY SCANNING mentioning tools and software used for different purposes and detailing the MITRE ATT&amp;CK Framework<\/li>\n\n\n\n<li>CIS (Centre for Internet Security)<\/li>\n\n\n\n<li>NIST<\/li>\n\n\n\n<li>ISO 27001<\/li>\n\n\n\n<li>COBIT<\/li>\n\n\n\n<li>STRIDE, DREAD, OWASP Threat modeling, Microsoft Threat Modeling Tool 2018, VAST, FOUR QUESTION FRAMEWORK<\/li>\n\n\n\n<li>Application security: SANS approach, PASTA<\/li>\n\n\n\n<li>Vulnerability severity score: CVSS calculator on the NIST website<\/li>\n\n\n\n<li>IoT SECURITY and Azure well-architected framework<\/li>\n<\/ul>\n\n\n\n<p>While this course focused heavily on Microsoft Azure and its solutions for cloud cybersecurity, it does provide a good base to someone like me who is starting out in cybersecurity. If you&#8217;re not particularly interested in cloud cybersecurity and specifically to Azure, I would probably look at other certifications. With Azure being so widely used, I think it can be certainly useful, however. Azure also offers a free subscription, so it can be a very useful tool for a learner to spin virtual machines and test things out (following their outlined rules of engagement!).<\/p>\n\n\n\n<p>The creation of the course is partly automated and there are often misspellings in the text, in case you are more of a reader than a watcher or want to copy some key concepts. Also, the graphics are often confusing or just useless, presenting action-consequence concepts in a list manner, and sometimes even opposite concepts with the same visual style in the same slide. But perhaps this is just my issue, having a background in digital design! Not a deal-breaker, but could have been done better. There I said it!<\/p>\n\n\n\n<p> For the Capstone project, you are required to design a network architecture for a small business that is moving to larger premises, over three floors, using the defense in depth model. The company uses an app that will need integrated. Details about the staff roles and number of users, as well as devices assigned to users are provided. You are guided to do this in five stages:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Company requirements, where you outline the scope of the project, the network design and the steps to implement the defined architecture<\/li>\n\n\n\n<li>Describing the proposed Azure AD configuration<\/li>\n\n\n\n<li>Describing the proposed Azure role and access configuration, including any required custom roles<\/li>\n\n\n\n<li>Specifications for testing the setup<\/li>\n\n\n\n<li>Policy implementation to establih a robust security framework.<\/li>\n<\/ol>\n\n\n\n<p>This final project was very useful to verify all the knowledge acquired and practicing netowrk design and planning a secure network by following the defense in depth model. While being obviously aimed at a configuration that uses Azure capabilities, security concepts could be applied to any network design.<\/p>\n\n\n\n<p>Considering the amount of Azure products and cybersecurity concepts covered, it was great to see it all united in a final practical project. When comparing my project with a provided examplar, I did realise I would have missed a couple of security measures: this enalbled me to identify any topics to review, adding to my learning experience.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Having just completed this certification, I wanted to reflect on my experience and discuss the capstone project that was required to complete the course (that and the SC-900 mock exam,&hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-33","post","type-post","status-publish","format-standard","hentry","category-projects"],"_links":{"self":[{"href":"https:\/\/cyberstec.com\/index.php\/wp-json\/wp\/v2\/posts\/33","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberstec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberstec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberstec.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberstec.com\/index.php\/wp-json\/wp\/v2\/comments?post=33"}],"version-history":[{"count":10,"href":"https:\/\/cyberstec.com\/index.php\/wp-json\/wp\/v2\/posts\/33\/revisions"}],"predecessor-version":[{"id":44,"href":"https:\/\/cyberstec.com\/index.php\/wp-json\/wp\/v2\/posts\/33\/revisions\/44"}],"wp:attachment":[{"href":"https:\/\/cyberstec.com\/index.php\/wp-json\/wp\/v2\/media?parent=33"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberstec.com\/index.php\/wp-json\/wp\/v2\/categories?post=33"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberstec.com\/index.php\/wp-json\/wp\/v2\/tags?post=33"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}