Describe general security and network security features Flashcards
O que é defesa profunda(defense in depth)?
The objective of defense in depth is to protect information and prevent it from being stolen by those who aren’t authorized to access it.
A defense-in-depth strategy uses a series of mechanisms to slow the advance of an attack that aims at acquiring unauthorized access to data.
what are the tier of defense of depth
The physical security layer is the first line of defense to protect computing hardware in the datacenter.
The identity and access layer controls access to infrastructure and change control. The perimeter layer uses distributed denial of service (DDoS) protection to filter large-scale attacks before they can cause a denial of service for users. The network layer limits communication between resources through segmentation and access controls. The compute layer secures access to virtual machines. The application layer helps ensure that applications are secure and free of security vulnerabilities. The data layer controls access to business and customer data that you need to protect.
what is firewall?
A firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules. You can create firewall rules that specify ranges of IP addresses. Only clients granted IP addresses from within those ranges are allowed to access the destination server. Firewall rules can also include specific network protocol and port information.
what is Azure firewall?
Azure Firewall is a managed, cloud-based network security service that helps protect resources in your Azure virtual networks. A virtual network is similar to a traditional network that you’d operate in your own datacenter.
What can I configure with Azure Firewall?
Application rules that define fully qualified domain names (FQDNs) that can be accessed from a subnet.
Network rules that define source address, protocol, destination port, and destination address. Network Address Translation (NAT) rules that define destination IP addresses and ports to translate inbound requests.
What are DDoS attacks?
A distributed denial of service attack attempts to overwhelm and exhaust an application’s resources, making the application slow or unresponsive to legitimate users. DDoS attacks can target any resource that’s publicly reachable through the internet, including websites.
What is Azure DDoS Protection?
Azure DDoS Protection (Standard) helps protect your Azure resources from DDoS attacks.
What are network security groups?
A network security group enables you to filter network traffic to and from Azure resources within an Azure virtual network. You can think of NSGs like an internal firewall. An NSG can contain multiple inbound and outbound security rules that enable you to filter traffic to and from resources by source and destination IP address, port, and protocol.
how to protect the Secure the perimeter layer?
The perimeter layer is about protecting your organization’s resources from network-based attacks. Identifying these attacks, alerting the appropriate security teams, and eliminating their impact are important to keeping your network secure. To do this:
Use Azure DDoS Protection to filter large-scale attacks before they can cause a denial of service for users. Use perimeter firewalls with Azure Firewall to identify and alert on malicious attacks against your network.
como Proteger a camada de rede?
Use network security groups to create rules that define allowed inbound and outbound communication at this layer. Here are some recommended practices:
Limit communication between resources by segmenting your network and configuring access controls. Deny by default. Restrict inbound internet access and limit outbound where appropriate. Implement secure connectivity to on-premises networks.
Pergunta:
An attacker can bring down your website by sending a large volume of network traffic to your servers. Which Azure service can help Tailwind Traders protect its App Service instance from this kind of attack?
Azure Firewall
Network security groups
Azure DDoS Protection
Azure DDoS Protection
DDoS Protection helps protect your Azure resources from DDoS attacks. A DDoS attack attempts to overwhelm and exhaust an application’s resources, making the application slow or unresponsive to legitimate users.
Pergunta:
What’s the best way for Tailwind Traders to limit all outbound traffic from VMs to known hosts?
Configure Azure DDoS Protection to limit network access to trusted ports and hosts.
Create application rules in Azure Firewall.
Ensure that all running applications communicate with only trusted ports and hosts.
Create application rules in Azure Firewall.
Azure Firewall enables you to limit outbound HTTP/S traffic to a specified list of fully qualified domain names (FQDNs).
Pergunta:
How can Tailwind Traders most easily implement a deny by default policy so that VMs can’t connect to each other?
Allocate each VM on its own virtual network.
Create a network security group rule that prevents access from another VM on the same network.
Configure Azure DDoS Protection to limit network access within the virtual network.
Create a network security group rule that prevents access from another VM on the same network.
A network security group rule enables you to filter traffic to and from resources by source and destination IP address, port, and protocol.
What’s Azure Security Center?
Azure Security Center is a monitoring service that provides visibility of your security posture across all of your services, both on Azure and on-premises. The term security posture refers to cybersecurity policies and controls, as well as how well you can predict, prevent, and respond to security threats.
what security center can do?
Security Center can:
Monitor security settings across on-premises and cloud workloads. Automatically apply required security settings to new resources as they come online. Provide security recommendations that are based on your current configurations, resources, and networks. Continuously monitor your resources and perform automatic security assessments to identify potential vulnerabilities before those vulnerabilities can be exploited. Use machine learning to detect and block malware from being installed on your virtual machines (VMs) and other resources. You can also use adaptive application controls to define rules that list allowed applications to ensure that only applications you allow can run. Detect and analyze potential inbound attacks and investigate threats and any post-breach activity that might have occurred. Provide just-in-time access control for network ports. Doing so reduces your attack surface by ensuring that the network only allows traffic that you require at the time that you need it to.
