deck_16822531 Flashcards

Question

Contoso Airways has adopted Azure as their cloud platform. Contoso has 2 offices: a head office in America and a secondary office in Japan. In Azure they have the following: “US Subscription” which has 2 resource groups * East US resource group which contains - Virtual network 1 *West US resource group which contains - Virtual network 4 “Japan Subscription” which has 1 resource group * Japan resource group which contains - Virtual network 5 Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than once correct solution, while others might not have a correct solution. You need to connect resources from VNet1 to Site 2 and Site 3. The connectivity solution must be encrypted and cost effective. Which of the following should you configure? A. Site to Site VPN B. Express Route C. Vnet Peering D. VNet to VNet connection

Answer 1

A. Site to Site VPN Explanation: Site-to-Site VPN is correct as this provides a connectivity solution between the required networks and uses IPsec encryption, this solution is also the most cost effective. Express route is incorrect as technically it can suffice as it is secure and can connect the required networks with each other, however the cost is considerably more than a VPN connection. VNet peering is incorrect as it can only be used to connect Azure virtual networks with each other and not on-premises to Azure networks. VNet-to-VNet connection is incorrect as this supports virtual networks in Azure and not on-premises workloads. https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal

Answer 2

D. VNet-to-VNet connection Explanation: VNet-to-VNet connection is correct as this provides a secure connectivity solution between the required networks, this connection also supports connectivity across different subscriptions and regions. Express route is incorrect as this is used to connect on-premises networks to Azure with low latency. VNet peering is incorrect as the traffic is not encrypted when traveling from one VNet to another VNet. Site-to-Site VPN is incorrect as this is method is used to connect on-premises networks to Azure networks, however both Site-to-Site and VNet-to-VNet connections makes use of a VPN gateway on each VNet. https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq

Answer 3

C. VNet Peering Explanation: VNet peering is correct as this is does not route traffic over the public internet, it routes traffic over the Microsoft backbone, however the data routed is not encrypted. Site-to-Site VPN is incorrect as this is method is used to connect on-premises networks to Azure networks and routes encrypted traffic over the public internet. Express route is incorrect as this is used to connect on-premises networks to Azure with low latency at a higher cost. VNet-to-VNet connection is incorrect as this routes encrypted traffic over the public internet and also is more expensive than VNet peering. https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

Answer 4

B. Create outbound NSG rule with an Internet service tag and set the action to Deny Explanation: Option 2 is correct. You need to create an OUTBOUND NSG rule with an “Internet” service tag as this will automatically block the VM from accessing the internet with the built-in service tag, the deny action is correct. https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

Answer 5

B. FALSE Explanation: False, you need to make use of Application Security Groups (ASG’s). ASG’s allows you to group VM’s to make management easier, for example you can group several VMs with an ASG and only make changes once to the ASG instead of manually adding/removing/editing NSG rules with CIDR notation. https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#application-security-groups

Answer 6

C. Configure IP ranges under the firewall section and specify 197.145.42.202/32 E. Allow read access to storage metrics from any network Explanation: Option 3 is correct as you need to specify the public IP address range you want to allow under the firewall section for the storage account. Option 5 is also correct as you need to allow only read access to storage metrics from any network. Option 1 is incorrect as you cannot specify the public IP address under the “selected networks” section as this is used to allow access from Virtual Networks in Azure to the storage account. Option 2 is incorrect as you should not configure “allow access from all networks” as you need to limit the access to specific public IPs as described in the scenario. Option 4 is incorrect as this will only allow Microsoft services access to the storage account and not the users from the Head Office. https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security

Answer 7

A. Real-time protection B. Malware remediation C. Exclusions D. Anti-malware engine and platform updates Explanation: All of the above are correct. When deploying Microsoft antimalware for Azure applications, some of the features are: real-time protection, malware remediation, exclusion of files, processes and drives, and automatic updates to the antimalware engine and platform. https://docs.microsoft.com/en-us/azure/security/azure-security-antimalware

Answer 8

B. Data discovery and classification C. Vulnerability assessment E. Advanced threat protection Explanation:

Answer 9

A. Kerberos Explanation: Azure HDInsight uses Kerberos authentication provided through integration with Azure Active Directory Domain Services. The other authentication standards are not supported. https://docs.microsoft.com/en-us/azure/hdinsight/domain-joined/apache-domain-joined-architecture

Answer 10

D. Cluster security Explanation: Perimeter, authentication, authorisation and data layer security is recommended. Cluster security is not considered part of deploying Azure HDInsight security. https://docs.microsoft.com/en-us/azure/hdinsight/domain-joined/apache-domain-joined-introduction

Answer 11

C. Apache Ranger Explanation: Apache Ranger is used to create RBAC policies in Azure HDInsight. HDInsight is integrated with Azure AD DS for Kerberos authentication services, but RBAC is handled in the HDInsight cluster itself using Apache Ranger. https://docs.microsoft.com/en-us/azure/hdinsight/domain-joined/apache-domain-joined-introduction#authorization

Answer 12

B. Azure Storage Service Encryption Explanation: HDInsight integrates with Azure Blob storage and Azure Data Lake Storage as the underlying storage infrastructure which is automatically encrypted by Azure Storage Service Encryption. SSE uses AES 256-bit, but this is not the best answer for the question. The Apache components is not responsible for encryption. https://docs.microsoft.com/en-us/azure/hdinsight/domain-joined/apache-domain-joined-introduction#encryption

Answer 13

C. Cosmos DB Firewall Explanation: Azure Cosmos DB has a built-in firewall service. Similar to any other database firewall, a firewall rule is required for all sites and over-the-internet connections to the database. This is the best answer to the question. Network security groups, Azure Firewall and a 3rd party firewall appliance commonly referred to as a network security appliance can all also be configured as an additional layer of security - but this is not the best answer to the question. AAD conditional access and AIP is not directly involved in Cosmos DB access control. https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-configure-firewall#configure-ip-policy

Answer 14

D. Resource Token F. Master Key Explanation: Cosmos DB uses a Master Key for administrative resources: database accounts, databases, users, and permissions. It also uses a Resource Token for application resources: containers, documents, attachments, stored procedures, triggers, etc. https://docs.microsoft.com/en-us/azure/cosmos-db/database-security#how-does-azure-cosmos-db-secure-my-database

Answer 15

B. Azure Storage Service Encryption Explanation: Azure storage encryption is used to encrypt data at rest for Cosmos DB. HMAC is used in Cosmos DB authorisation, but not for data encryption. Applications can make use of Cosmos DB by storing the access tokens in Azure Key Vault instead of with the application. SSL/TLS is used by the system to ensure data protection (encryption) in transit. https://docs.microsoft.com/en-us/azure/cosmos-db/database-encryption-at-rest

Answer 16

B. Azure Storage Service Encryption Explanation: Azure Data Lake is built on Azure Storage, just like Blobs, Tables and Queues. It uses the same underlying encryption for data at rest - Storage Service Encryption. SSE uses AES 256-bit as the underlying encryption algorithm, but this is not the best answer for the question. SSL/TLS is encryption for data in transit, not data at rest. Azure Key Vault can be used for SSE in a Bring Your Own Key scenario, but does not perform encryption itself. Bitlocker is Microsoft's encryption technology used on the endpoint, not relevant for SSE. https://docs.microsoft.com/en-za/azure/storage/common/storage-service-encryption?toc=%2fazure%2fstorage%2fblobs%2ftoc.json#view-encryption-settings-in-the-azure-portal