7. Security Flashcards
What are the 7 general layers of defense?
Briefly Describe each layer
Topic: Defense in Depth
- Physical - actual data center, only authorized personnel has access
- Identiy and access - relates to Azure AD
- Perimiter - protection against attacks
- Network - filter of traffic to/from Azure using VNets
- Compute - protects from intruders trying to access VMS or databases
- App Gateways and Firewalls - provides security to Azure apps
- Data - encrpyting data and protecting against unauthorized users
What security does a firewall offer?
Topic: Securing Network Connectivity
Firewalls control data coming in/our of network using rules.
How do rules relate to firewalls?
Topic: Securing Network Connectivity
Firewalls define rules for what kind of traffic can and cannot access the device or service behind it.
What is a Network Security Group (NSG)?
Topic: Securing Network Connectivity
A NSG is a more targeted, personal firewall that can be attached to a VNet, subnet, or VM.
What is a public endpoint, and what are the drawbacks from using one?
Topic: Public and Private Endpoints
Public endpoints are default for PaaS services, and public endpoints are able to be reached over the internet (publicly). The drawback is that anyone can attempt to access services over the internet.
What two solutions are better than using public endpoints?
Topic: Public and Private Endpoints
- Service endpoints
- Private endpoints
Describe service endpoints.
List 3 drawbacks compared to private endpoints.
Topic: Public and Private Endpoints
Service endpoints connect VNet subnets to Azure PaaS Services.
Drawbacks:
1. No private access from on-premisis
2. PaaS public endpoint still exist
3. Only able to access entire services, not instances of services
Describe private endpoints.
What are the 3 beneifts compared to service endpoints.
Topic: Public and Private Endpoints
Managed network interface that sits inside of a subnet.
Benefits:
1. Privately access services from on premisis or peered VNets
2. PaaS public endpoint is disabled
3. Private connection to a specific instance of a service
What is Microsoft Defender for Cloud?
Topic: Microsoft Defender for Cloud
A portal that provides threat alerts that Azure Detects.
What are the three steps for using Microsoft Defender for Cloud?
Topic: Microsoft Defender for Cloud
- Define policies for Azure to monitor
- Protect resources actively through monitoring policy outcomes
- Respond to security alerts
What is the Resource Security Hygiene dashboard?
What does hygiene refer to?
Topic: Microsoft Defender for Cloud
A dashboard that show’s your resources hygiene. Hygiene refers to how resources are configured in relation to security best practices
