Protection and Security (AZ-900)

• Key Vault: secrets, keys, certs; HSM-backed options
• DDoS Protection: Basic vs Standard
• Azure Firewall: managed, static public IP, HA
• AIP: label and protect docs & emails
• App Gateway + WAF: L7 web traffic with rules
• Defender for Identity (formerly ATP): detect threats using AD signals
• SDL, Policy, RBAC, Locks: governance & access control