Describe General Security and Network Security Features

Question 1

____________ is a monitoring service that provides visibility of your security posture across all of your services, both on Azure and on-premises.

Answer 1

Azure Security Center

Question 2

The Azure product that can:

• Provide security recommendations based on your current config, resources, & networks
• Detect & block malware
• Analyze & identify potential attacks
• Just-in-time access control for ports

Answer 2

Azure Security Center

Question 3

____________ refers to cybersecurity policies and controls, as well as how well you can predict, prevent, and respond to security threats.

Answer 3

security posture

Question 4

Azure Security Center capabilities include 4 main components. Name the 4.

Answer 4

• Policy compliance
• Continuous assessments
• Tailored recommendations
• Threat protection

Question 5

____________ is a measurement of an organization’s security posture and is based on security controls, or groups of related security recommendations. It is based on the percentage of security controls that you satisfy. The more security controls you satisfy, the higher the rating you receive. It improves when you remediate all of the recommendations for a single resource within a control.

Answer 5

Secure score

Question 6

____________ access blocks traffic by default to specific network ports of VMs, but allows traffic for a specified time when an admin requests and approves it.

Answer 6

Just-in-time VM access

Question 7

A company can control which applications are allowed to run on its VMs. In the background, Security Center uses machine learning to look at the processes running on a VM. It creates exception rules for each resource group that holds the VMs and provides recommendations. This process provides alerts that inform the company about unauthorized applications that are running on its VMs. What is this threat protection called?

Answer 7

Adaptive application controls

Question 8

Security Center can monitor the internet traffic patterns of the VMs, and compare those patterns with the company’s current network security group (NSG) settings. From there, Security Center can make recommendations about whether the NSGs should be locked down further and provide remediation steps. This threat protection capability is called __________________.

Answer 8

Adaptive network hardening

Question 9

__________ allows a company to configure the monitoring of changes to important files on both Windows and Linux, registry settings, applications, and other aspects that might indicate a security attack.

Answer 9

File integrity monitoring

Question 10

___________ uses Azure Logic Apps and Security Center connectors, which are triggered by a threat detection alert or by a Security Center recommendation, filtered by name or by severity. You can then configure the logic app to run an action, such as sending an email, or posting a message to a Microsoft Teams channel. This allows you to investigate or remediate alerts.

Answer 10

Workflow automation

Question 11

Security management on a large scale can benefit from a dedicated security information and event management (SIEM) system. A SIEM system aggregates security data from many different sources (as long as those sources support an open-standard logging format). It also provides capabilities for threat detection and response.

___________ is Microsoft’s cloud-based SIEM system. It uses intelligent security analytics and threat analysis.

Answer 11

Azure Sentinel

Question 12

_____________ enables you to:

• Collect cloud data at scale Collect data across all users, devices, applications, and infrastructure, both on-premises and from multiple clouds.
• Detect previously undetected threats Minimize false positives by using Microsoft’s comprehensive analytics and threat intelligence.
• Investigate threats with artificial intelligence Examine suspicious activities at scale, tapping into years of cybersecurity experience from Microsoft.
• Respond to incidents rapidly Use built-in orchestration and automation of common tasks.

Answer 12

Azure Sentinel

Question 13

What threat detection product include connectors / integrations for these products:

• Office 365
• Azure Active Directory
• Azure Advanced Threat Protection
• Microsoft Cloud App Security

Answer 13

Azure Sentinel

Question 14

When a company builds its workloads in the cloud, it needs to carefully handle sensitive information such as passwords, encryption keys, and certificates. This information needs to be available for an application to function, but it might allow an unauthorized person access to application data. _________ is a centralized cloud service for storing an application’s secrets in a single, central location. It provides secure access to sensitive information by providing access control and logging capabilities.

Answer 14

Azure Key Vault

Question 15

What product are these 5 benefits attributed to?

• Centralized application secrets Centralizing the storage for your application secrets enables you to control their distribution, and reduces the chances that secrets are accidentally leaked.
• Securely stored secrets and keys Azure uses industry-standard algorithms, key lengths, and HSMs. Access to Key Vault requires proper authentication and authorization.
• Access monitoring and access control By using Key Vault, you can monitor and control access to your application secrets.
• Simplified administration of application secrets Key Vault makes it easier to enroll and renew certificates from public certificate authorities (CAs). You can also scale up and replicate content within regions and use standard certificate management tools.
• Integration with other Azure services You can integrate Key Vault with storage accounts, container registries, event hubs, and many more Azure services. These services can then securely reference the secrets stored in Key Vault.

Answer 15

Azure Key Vault

Question 16

A _________ gives you access to free resources. Your personal subscription will not be charged. It may only be used to complete training on Microsoft Learn. Use for any other reason is prohibited, and may result in permanent loss of access to it.

Answer 16

sandbox

Question 17

Some organizations must follow regulatory compliance that requires them to be the only customer using the physical machine that hosts their virtual machines. ___________ provides physical servers to host your Azure VMs for Windows and Linux.

Answer 17

Azure Dedicated Host

Question 18

True or false: A dedicated host is mapped to a physical server in an Azure datacenter. A host group is a collection of dedicated hosts.

Answer 18

True

Question 19

These are benefits of what product?

• Gives you visibility into, and control over, the server infrastructure that’s running your Azure VMs.
• Helps address compliance requirements by deploying your workloads on an isolated server.
• Lets you choose the number of processors, server capabilities, VM series, and VM sizes within the same host.

Answer 19

Azure Dedicated Host

Question 20

To provide the best availability with the Azure Dedicated Host product, you can provision multiple hosts in a ________ and deploy your VMs across it.

Answer 20

host group

Question 21

VMs on dedicated hosts can also take advantage of ______________. This feature enables you to control when regular maintenance updates occur, within a 35-day rolling window.

Answer 21

maintenance control

Question 22

Referring to the attached image, How can Tailwind Traders enforce having only certain applications run on its VMs?

• Connect your VMs to Azure Sentinel.
• Create an application control rule in Azure Security Center.
• Periodically run a script that lists the running processes on each VM. The IT manager can then shut down any applications that shouldn’t be running.

Answer 22

Create an application control rule in Azure Security Center.

With Azure Security Center, you can define a list of allowed applications to ensure that only applications you allow can run. Azure Security Center can also detect and block malware from being installed on your VMs.

Question 23

Referring to the attached image, What’s the easiest way for Tailwind Traders to combine security data from all of its monitoring tools into a single report that it can take action on?

• Collect security data in Azure Sentinel.
• Build a custom tool that collects security data, and displays a report through a web application.
• Look through each security log daily and email a summary to your team.

Answer 23

Collect security data in Azure Sentinel

Azure Sentinel is Microsoft’s cloud-based SIEM. A SIEM aggregates security data from many different sources to provide additional capabilities for threat detection and responding to threats.

Question 24

Referring to the attached image, Which is the best way for Tailwind Traders to safely store its certificates so that they’re accessible to cloud VMs?

• Place the certificates on a network share.
• Store them on a VM that’s protected by a password.
• Store the certificates in Azure Key Vault.

Answer 24

Store the certificates in Azure Key Vault

Azure Key Vault enables you to store your secrets in a single, central location. Key Vault also makes it easier to enroll and renew certificates from public certificate authorities (CAs).

Question 25

Referring to the attached image, How can Tailwind Traders ensure that certain VM workloads are physically isolated from workloads being run by other Azure customers?

• Configure the network to ensure that VMs on the same physical host are isolated.
• This is not possible. These workloads need to be run on-premises.
• Run the VMs on Azure Dedicated Host.

Answer 25

Run the VMs on Azure Dedicated Host

Azure Dedicated Host provides dedicated physical servers to host your Azure VMs for Windows and Linux.

Question 26

The objective of __________ is to protect information and prevent it from being stolen by those who aren’t authorized to access it. This strategy uses a series of mechanisms to slow the advance of an attack that aims at acquiring unauthorized access to data leveraging multiple levels of protection as one layer is isolated from the subsequent.

Answer 26

defense in depth

Question 27

Identify the 7 layers of the defense in depth strategy.

Answer 27

1. The physical security layer is the first line of defense to protect computing hardware in the datacenter.
2. The identity and access layer controls access to infrastructure and change control.
3. The perimeter layer uses distributed denial of service (DDoS) protection to filter large-scale attacks before they can cause a denial of service for users.
4. The network layer limits communication between resources through segmentation and access controls.
5. The compute layer secures access to virtual machines.
6. The application layer helps ensure that applications are secure and free of security vulnerabilities.
7. The data layer controls access to business and customer data that you need to protect.

Question 28

The _________ layer is the first line of defense to protect computing hardware in the datacenter. the intent is to provide physical safeguards against access to assets. These safeguards ensure that other layers can’t be bypassed, and loss or theft is handled appropriately.

Answer 28

• The physical security layer is the first line of defense to protect computing hardware in the datacenter.

Question 29

The ________ layer controls access to infrastructure and change control. At this layer, it’s important to:

• Control access to infrastructure and change control.
• Use single sign-on (SSO) and multifactor authentication.
• Audit events and changes.

Answer 29

• The identity and access layer controls access to infrastructure and change control. This layer is all about ensuring that identities are secure, access is granted only to what’s needed, and sign-in events and changes are logged.

Question 30

The __________ layer uses distributed denial of service (DDoS) protection to filter large-scale attacks before they can cause a denial of service for users. At this layer, it’s important to:

• Use DDoS protection to filter large-scale attacks before they can affect the availability of a system for users.
• Use firewalls to identify and alert on malicious attacks against your network.

Answer 30

• The perimeter layer uses distributed denial of service (DDoS) protection to filter large-scale attacks before they can cause a denial of service for users.

Question 31

The __________ layer limits communication between resources through segmentation and access controls. At this layer, it’s important to:

• Limit communication between resources.
• Deny by default.
• Restrict inbound internet access and limit outbound access where appropriate.
• Implement secure connectivity to on-premises networks.

At this layer, the focus is on limiting the connectivity across all your resources to allow only what’s required. By limiting this communication, you reduce the risk of an attack spreading to other systems.

Answer 31

• The network layer limits communication between resources through segmentation and access controls.

Question 32

The ______ layer secures access to virtual machines. At this layer, it’s important to:

• Secure access to virtual machines.
• Implement endpoint protection on devices and keep systems patched and current.

Malware, unpatched systems, and improperly secured systems open your environment to attacks. The focus in this layer is on making sure that your resources are secure and that you have the proper controls in place to minimize security issues.

Answer 32

• The compute layer secures access to virtual machines.

Question 33

The _________ layer helps ensure that your products are secure and free of security vulnerabilities. At this layer, it’s important to:

• Ensure that your products are secure and free of vulnerabilities.
• Store sensitive secrets in a secure storage medium.
• Make security a design requirement for all development.

Answer 33

• The application layer helps ensure that applications are secure and free of security vulnerabilities. Integrating security into the application development lifecycle helps reduce the number of vulnerabilities introduced in code. Every development team should ensure that its applications are secure by default.

Question 34

The _________ layer controls access to business and customer data that you need to protect.

Answer 34

The data layer controls access to business and customer data that you need to protect. In almost all cases, attackers are after data:

• Stored in a database.
• Stored on disk inside virtual machines.
• Stored in software as a service (SaaS) applications, such as Office 365.
• Managed through cloud storage.

Those who store and control access to data are responsible for ensuring that it’s properly secured. Often, regulatory requirements dictate the controls and processes that must be in place to ensure the confidentiality, integrity, and availability of the data.