305 - Azure Architect Flashcards
Your company has an Azure Subscription. The company wants a way to enforce org standards and to assess compliance at the subscription level and have the standards apply throughout the organization.
If compliance standards change, you should be able to update the standards and bring resources into compliance through bulk remediation. Remediation for new resources should be automatic.
Which solution meets these requirements?
- Azure Managed Identities
- ARM Templates
- Azure Conditional Access
- Azure Policy
Azure Policy -
Lets you enforce organizational standards at any point in your hierarchy, from mgmt groups to individual resource level.
You are designing a monitoring solution for a gaming website hosted in an Azure Web App. Following Requirements
- Track how often users return to the website in a specified time period
- Measure how specific events influence user activities
- View user activity by region.
You need to provide a solution that minimizes admin effort.
- Time Series Insights environments
- Azure Monitor Alerts
- application Insights
- Azure AI Services
Application Insights: Retention feature that enables tracking of user behavior.
Azure Monitor helps detect potential problems with application or infrastructure
You are managing the Entra environment for your organization. You need to enable secure access for applications and services to Azure resources or applications. Which account or identity should you create for this purpose?
- Device Identity
- User Account
- group Managed Service account (gMSa)
- Service Principal Identity
Application Identity that you create in Entra to provide secure authentication and authorization for applications and services
You create an Azure subscription for your company. You plan to create a resource group for each department in your company. You want to allow only members of a particular department create resources in the resource group assigned to their department. Which azure feature should you use?
- RBAC
- Initiviates
- Locks
- Policies
- RBAC
You need to recommend a storage design solution on the Azure Cloud platform for marketing departments documents on a slow web page server. Move from File Share Servers to the Cloud. Which?
- BLOB
- Azure Files
- Queue Storage
- Managed Disks
Azure Files offers a fully managed file share solution that supports SMB (Server Message Block) protocol, which is ideal for seamlessly migrating existing file shares to the cloud.
- Easy Integration: It allows users to access files via familiar file share paths, making it straightforward for the marketing department to adapt to cloud storage without changing workflows.
- Web Page Access: Since the web page server is slow, Azure Files will provide cloud-based file access that can be managed independently of the web server, potentially improving response times.
Blob Storage could also work for storing documents but is more suited for unstructured data (e.g., images, videos) that don’t require typical file-sharing protocols.
You are tasked with recommending security tools for in order to protect data at rest, in transit and in use.
Which 3 should you recommend?
- Transparent Data Encryption
- Always Encrypt
- Firewall
- Network Security Groups (NSG)
- SSL / TLS
Transparent Data Encryption (TDE): TDE protects data at rest by encrypting the data within databases and stored files, helping to secure sensitive data against unauthorized access.
Always Encrypted: Always Encrypted protects data in use and at rest by encrypting sensitive data within applications before it reaches the database. This ensures that even database administrators cannot view the encrypted data, offering strong security for highly sensitive data.
SSL/TLS: SSL/TLS protocols protect data in transit by encrypting data as it moves between clients, applications, and servers, ensuring secure communication and preventing interception or tampering.
A medium sized company is using Entra ID to control access to their applications and services that are deployed in Azure. A recent security audit shows that the Global Administrator group is populated with people who do not need such broad access.
You need to restrict appropriately && want to able to grant elevated access only for specific periods of time (ie day or hour) when a person needs for specific task. What 2 actions should you perform?
- Managed identities to further restrict access the resources
- Privileged Identity Managed (PIM) to create additional rules for access
- Add conditional access policies to your current restrictions
- Assign more granular roles to the admin.
Use Privileged Identity Management (PIM) to create additional rules for access**: Azure PIM enables you to enforce just-in-time access, allowing administrators to gain elevated permissions only for specific periods. With PIM, you can also require approval workflows, multi-factor authentication (MFA), and alerts for elevated role assignments, ensuring that Global Administrator access is restricted to only those who need it temporarily.
Assign more granular roles to the admin: Reducing the scope of permissions by assigning more granular roles aligns with the principle of least privilege, granting users access only to the specific resources and actions they need. This removes unnecessary permissions from the Global Administrator role and assigns roles like Application Administrator or User Administrator as needed.
You are migrating on-prem workloads running windows and Linux VM to azure.
Need a monitoring strategy solution so that the logs and metrics are available in a centralized location in Azure. the logs should be store for at least 18 months and must be easy to view and query. Which solution?
- Event Hubs
- Log Analytics
- A Storage Account
Log Analytics
You are designing a monitoring solution for a microservice solution hosted in AKS Cluster
You need to recommend a monitoring solution that meets the following requirements:
- Measure the memory consumption of cluster nodes
- Monitor the health of pods and deployments
- Create alerts when persistent voluemes more than 80% full
- Visualize the metrics and dashboards within the Azure Portal
- Container Insights
You are managing an Azure hybrid environment with resources both on-premises and in the cloud. Your task is to collect all diagnostic and audit logs centrally in an external third-party Security Information and Event Management (SIEM) system.
Requirement
Recommend the most suitable solution to route resource logs to an external third-party SIEM. The solution must allow for flexibility in real-time processing and enable routing of logs to different destinations.
Options
- Azure Storage Account
- Azure Service Bus
- Azure Log Analytics Workspace
- Azure Event Hubs
Azure Event Hubs is the most suitable option for routing resource logs to an external SIEM because it is specifically designed for high-throughput data streaming and real-time event ingestion. It allows you to:
Integrate with third-party SIEMs: Many SIEM systems can connect directly to Azure Event Hubs to retrieve logs and events in real time.
Support real-time processing: Azure Event Hubs allows logs to be processed in near real-time, providing the flexibility to respond quickly to security events.
Route logs to multiple destinations: By leveraging Event Hubs, you can set up different consumer groups for simultaneous streaming to various destinations, including analytics and storage platforms, along with your external SIEM.
Your company has an on prem Active Directory (AD) domain that uses AD Connect to access Microsoft Entra ID.
Employees use single sign on (SSO) from corporate devices or their own devices to gain access to resources do their jobs. IT administrators reported the the RDP port of the on-prem AD server was open to perform a one-time admin task.
After reports of identity theft at a partner company - you need to
- Close RDP
- Enable MS Entra Conditional Access
- Disable Password Hash Sync
- Require Strong Password
Your company has a Microsoft Entra tenant named company.com. The company has a marketing, finance, and research dept.
You are designing MFA for company.com. You need to ensure that MFA is only implemented for users in the research department. Which requirement should you include in your design?
- Implement PIM
- Configure authentication methods
- Conditional Access Policy
- Implement Entra ID protection
Using a Conditional Access Policy allows you to specify conditions, such as user department, to enforce MFA selectively. In this case, you can create a policy that applies MFA requirements only to users in the research department by:
Defining the user group or department as a condition in the policy.
Specifying MFA as the required control for this group.
This approach is targeted, flexible, and ensures that only users in the research department need to complete MFA, without impacting other departments.
Other Options:
PIM (Privileged Identity Management): Used for managing and controlling privileged access, not for applying MFA by department.
Configure Authentication Methods: While configuring authentication methods is part of MFA, it does not control who MFA is applied to.
Entra ID Protection: Primarily focuses on risk-based policies, which apply dynamically based on risk rather than specific department or group policies.
You have a hybrid identity environment that includes an on-premises Active Directory environment and a Microsoft Entra ID.
You need to create an authentication solution that verifies the following:
- On Prem AD Security Policies Applied
- Passwords are Validated against your on-premise AD
- Passwords are not stored in the cloud
Which solution is best?
- SSO
- Password Hash Sync
- Pass Through Authentication
- Federated Authentication
You create an Azure subscription for your company. You plan to create a resource group for each department in your company.
You want to allow only members of a particular department to create resources in the resource group in the department.
Which azure feature?
* Locks
* Initiatives
* Policies
* RBAC
RBAC helps you control which users or groups have access to resources and which permissions they have on those resources.
Locks allow you to prevent resources from being modified or deleted
Policies allow you to configure rules that control the types of Azure resources that are allowed in a subscription or resource groups.
Initiatives are groups of policies.
Company has a Entra tenant named company1.com
Company uses groups to provide access to resource. Each employee has a user in company.com
You need to recommend a solution to automatically remove users from groups that they are no longer need to be in
What do you recommend?
- Conditional Access
- Group Expiration
- Access Review
- Entra ID Protection
Access Review in Microsoft Entra ID (formerly Azure AD) allows you to set up periodic reviews to evaluate and remove users who no longer need access to specific groups or resources. It can be configured to automatically remove users if they fail to respond to the review, streamlining group membership management and helping ensure only necessary access is maintained.
Here’s how it would help in this case:
Regularly Review Group Membership: Allows you to define rules for users to confirm their need for access, prompting group owners or users to review their memberships.
Automated Removal: Users who no longer need access can be removed based on review outcomes, which keeps groups clean and maintains security.
The other options do not directly address group membership management in the same way:
Conditional Access controls access to resources based on conditions but does not manage group memberships.
Group Expiration applies only to groups with expiration policies, not necessarily to access needs.
Entra ID Protection focuses on identity protection rather than group membership management.
