IT Labs Portfolio · Microsoft AI Skills Fest
LAB-003

Security Pro —
Strengthen Security Foundations

A Microsoft AI Skills Fest interactive lab building a core understanding of modern security concepts, threats, and protections across identities, data, devices, infrastructure, and AI systems. Completed two real-world security scenarios using drag-and-drop architecture design, hotspot threat analysis, multiple-choice assessments, and Zero Trust implementation planning — all within Microsoft's guided interactive learning environment.

Status Completed
Category Cybersecurity / Zero Trust
Platform Microsoft AI Skills Fest
Format Interactive Case Study
Completed June 8, 2026
Microsoft AI Skills Fest Badge
// Microsoft AI Skills Fest
// Overview

Lab Details

Objective
  • Analyze real-world security scenarios for fictitious organizations
  • Identify security gaps across multicloud and hybrid environments
  • Apply Zero Trust principles to architecture design
  • Map Microsoft security tools to specific threats
  • Design and sequence secure solutions end-to-end
  • Reflect on DevSecOps maturity and governance gaps
Tools & Technologies
  • Microsoft Defender for Endpoint
  • Microsoft Defender for IoT
  • Microsoft Sentinel — SIEM & SOAR
  • Azure Arc — hybrid governance
  • Microsoft Intune — endpoint management
  • Azure Key Vault — secrets management
  • GitHub Advanced Security
  • Azure Private Link
  • Defender for Cloud DevOps
Skills Demonstrated
  • Zero Trust architectural reasoning
  • Threat analysis and risk assessment
  • Multicloud security design (Azure + AWS)
  • Hybrid infrastructure security planning
  • DevSecOps principles and CI/CD security
  • OT/IoT security awareness
  • Endpoint and identity management
  • Security operations and threat detection
// Case Studies Completed

Two Scenarios

CASE STUDY 01
Securing Apps and Data
Fabrikam Inc. — Fictitious e-commerce organization
Fabrikam operates across Azure and AWS deploying microservices in AKS and EKS clusters. The scenario presented fragmented DevOps security practices including manual secret rotation, public database endpoints, and inconsistent CI/CD pipeline controls exposing the organization to misconfigurations, credential leaks, and delayed threat detection.
CASE STUDY 02
Securing Endpoints and Infrastructure
Litware Inc. — Fictitious global manufacturing company (40+ sites)
Litware struggles with fragmented security across IT and OT environments. Regional autonomy created inconsistent governance, decentralized endpoint management, and delayed patching. Legacy industrial systems with default settings and flat networks increased exposure while security telemetry was siloed in regional tools creating enterprise-wide blind spots.
// Write-Up

Lab Documentation

Case Study 01 — Securing Apps and Data (Fabrikam Inc.)

Situation Assessment: Reviewed Fabrikam Inc.'s dual-cloud environment running microservices across Azure Kubernetes Service (AKS) and Amazon Elastic Kubernetes Service (EKS). Identified the following security gaps:

  • Static Kubernetes secrets and long-lived tokens used for service-to-service authentication with manual rotation and limited visibility
  • Database connections relying on public endpoints and connection strings — no network-layer isolation
  • CI/CD pipelines lacking centralized security governance — misconfigurations reaching production
  • Open-source dependency management relying on manual developer vigilance without integrated scanning
  • Monitoring fragmented across cloud-native tools with inconsistent triage and limited threat detection

Case Study 01 — Threat Analysis

Translated the operational weaknesses into tangible threats and identified the following risks:

  • Credential exposure — manual secret handling and static tokens create high-value targets for attackers
  • Misconfiguration vulnerabilities — infrastructure-as-code and admission policy gaps introduce persistent attack surfaces
  • Supply chain risks — unscanned dependencies and insecure CI/CD workflows expose the build pipeline
  • Data exposure — public database endpoints and insufficient encryption put sensitive data at risk
  • Delayed detection — fragmented monitoring and reactive diagnostics slow incident response

Case Study 01 — Architectural Solution Designed

Designed a Zero Trust–aligned DevSecOps framework using integrated Microsoft tools to address Fabrikam's risks:

  • Azure Arc — extends governance and policy enforcement to Amazon EKS clusters across both clouds
  • GitHub Advanced Security + Defender for Cloud DevOps — enables shift-left security through code and infrastructure scanning
  • Workload identities — replaces static credentials with short-lived tokens tied to pod identities
  • Azure Key Vault + Always Encrypted + Azure Private Link — strengthens data protection and secure connectivity
  • Microsoft Sentinel — correlates telemetry across pipelines, runtimes, and cloud apps for unified threat detection

Case Study 02 — Securing Endpoints and Infrastructure (Litware Inc.)

Situation Assessment: Reviewed the current architecture at Litware Inc. — a global manufacturer with more than 40 sites spanning IT and OT environments. Completed a hotspot activity identifying risks across the live architecture diagram including Litware plant, facility, edge computing nodes, SIEM tools, Azure subscriptions, and Entra tenant. Identified the following security gaps:

  • Decentralized endpoint management leading to inconsistent patching and delayed remediation
  • OT/IoT systems operating on flat networks with default credentials and legacy protocols — uptime prioritized over security
  • Regional cloud deployments lacking centralized governance — visibility and configuration gaps across sites
  • Security telemetry processed locally using disparate SIEM tools — no enterprise-wide threat correlation
  • Public internet used for telemetry flow — exposing sensitive operational data

Case Study 02 — Threat Analysis

Identified the following threats resulting from Litware's operational weaknesses:

  • Malware entry — unmanaged endpoints and inconsistent patching create wide-open attack surfaces
  • Lateral movement — OT/IoT flat networks and default credentials allow attackers to move freely
  • Misconfigured cloud resources — decentralized provisioning creates exploitable gaps across regional deployments
  • Third-party access risks — unmanaged contractor devices accessing internal systems without governance
  • Blind spots in threat detection — siloed telemetry and skill disparities across regions limit visibility
  • Telemetry exposure — sensitive operational data transmitted over public internet paths

Case Study 02 — Architectural Solution Designed

Designed a Zero Trust–aligned hybrid security framework and sequenced the implementation steps using the drag-and-drop activity and carousel-based deployment visualization:

  • Microsoft Intune + Defender for Endpoint — unified endpoint management and compliance enforcement across all 40+ sites
  • Defender for IoT — agentless, protocol-aware monitoring of OT environments without disrupting operations
  • Azure Arc + Defender for Cloud — extends governance and threat protection to hybrid infrastructure across all regions
  • IoT Hub + IoT Edge + Private Endpoints — secure telemetry routing and cloud integration — eliminates public internet exposure
  • Microsoft Sentinel + Defender XDR — centralized threat correlation and response across IT, OT, and cloud domains

Implementation was sequenced across five phases: establish endpoint security baseline → enhance threat detection and automated response → deploy centralized security monitoring → secure OT and IoT assets → modernize edge and hybrid infrastructure.

// Lab Screenshots

Documentation Screenshots

Screenshots taken during the interactive lab. Upload to assets/images/ named lab003-01.png, lab003-02.png etc.

// Case Study 01 — Securing Apps and Data (Fabrikam Inc.) — Drag and Drop Activity
Fabrikam drag and drop question
Photo 01 — Question: Which solution extends Azure-native security, policy, and identity controls to Kubernetes workloads running in AWS EKS? Available choices: Azure Arc and Microsoft Defender for Endpoint
Azure Arc placed on EKS
Photo 02 — Azure Arc placed next to the AWS EKS cluster — demonstrating that EKS can be connected to Azure for centralized security and management across both clouds
Feedback confirming Azure Arc
Photo 03 — Feedback confirms Azure Arc is correct: it enables centralized visibility and compliance enforcement for Kubernetes across AKS and EKS. Microsoft Defender for Endpoint is not suitable — it protects end-user devices and servers, not Kubernetes clusters
// Case Study 01 — Securing Apps and Data (Fabrikam Inc.) — Compliance Enforcement
Azure Policy question
Photo 04 — Question: Which solution enforces consistent security and compliance across code and deployment pipelines before reaching production? Available choices: Azure Policy and Microsoft Defender for Cloud Apps
Azure Policy placed in environment
Photo 05 — Azure Policy placed in the cloud environment as the selected answer for enforcing consistent compliance and security across code and deployment pipelines
Feedback confirming Azure Policy
Photo 06 — Feedback confirms Azure Policy is correct: it automates compliance enforcement for Kubernetes deployments across AKS and EKS through Azure Arc. Microsoft Defender for Cloud Apps is not the right choice for pre-production code or pipeline compliance
// Case Study 01 — Completed Solution Architecture
Completed solution architecture
Photo 07 — Completed solution architecture: AKS and EKS connected through Azure Arc and Azure Policy, Microsoft Defender tools, Microsoft Sentinel, Azure Monitor, Azure SQL, Cosmos DB, Private Links, VPN Gateway, GitHub, GitHub Actions, and Azure Container Registry working together to secure apps and data across the multicloud environment

// Upload additional screenshots to assets/images/ named lab003-07.png and above — add photo-item blocks following the same pattern

// Takeaways

Lessons Learned

LESSON 01
Zero Trust is not a product — it is a framework. No single tool implements Zero Trust. It requires layered controls across identity, data, devices, applications, and infrastructure working together with consistent policy enforcement.
LESSON 02
Fragmented monitoring creates blind spots that attackers exploit. When telemetry is siloed across regional tools, threat correlation becomes impossible. Centralized SIEM like Microsoft Sentinel is essential for enterprise-wide visibility.
LESSON 03
OT and IoT security requires a different approach. Legacy industrial systems prioritize uptime over security. Agentless monitoring tools like Defender for IoT are necessary because traditional agents cannot be installed on industrial equipment.
LESSON 04
Shift-left security means catching problems before they reach production. Integrating GitHub Advanced Security and Defender for Cloud DevOps into CI/CD pipelines finds misconfigurations and vulnerabilities at the code level — not after deployment.
LESSON 05
Static credentials are a critical risk. Long-lived tokens and manually rotated secrets are high-value targets. Replacing them with workload identities and short-lived tokens tied to specific pod identities eliminates credential sprawl.
LESSON 06
Architecture decisions have real security consequences. Every design choice — flat networks, public endpoints, decentralized governance — creates specific, exploitable vulnerabilities. Security must be designed in, not added on top.
← Lab 002: Setting Up a Virtual Lab Back to All Labs