Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Microsoft Azure Security Engineer > Secure networking > Flashcards

Secure networking Flashcards

1
Q

By default, do all resources in a virtual network can communicate outbound with the internet?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 3 ways resources in Azure can communicate with each other?

A
  1. Virtual Network/subnet
  2. Virtual Network Service Endpoint
  3. Virtual Network Peering
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the 3 ways resources in Azure can communicate with on-prem resources?

A
  1. Point-to-site VPN
  2. Site-to-site VPN
  3. Azure ExpressRoute
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Describe the purpose ‘Virtual network service endpoint’

A

Extend your virtual network’s private address space and allow connections into a separate network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the 2 ways virtual traffic between subnets can be filtered?

A
  1. Network security groups (NSGs)
  2. Network virtual appliances (NVAs)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Describe a ‘Network virtual appliance (NVA)’

A

A VM that performs a network function, such as a firewall or WAN optimization found in the Azure Marketplace or custom ISO.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Describe a ‘Network/Application security group’

A

Filter traffic to and from resources by source and destination IP address, port, and protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does a Network/Application security group contain?

A

A 5-tuple hash rule specifying how traffic should be filtered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Are Network/Application security groups stateless or stateful?

A

Stateful.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Does a Network/Application security group affect new connections?

A

Existing connections may not be interrupted; Modifying network security group rules will only affect new connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

For inbound traffic, in what direction does Azure process rules in a network security group?

A

Azure processes the rules associated to a subnet first and then the rules in a network security group associated to the network interface.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

For outbound traffic, in what direction does Azure process rules in a network security group?

A

Azure processes the rules associated to a network interface first and then the rules in a network security group associated to the subnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

By default, can resources in a virtual subnet communicate with each other?

A

Yes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Describe the purpose of the ‘IP Flow Verify’ function

A

Determine whether a communication is allowed or denied and verify to surface the identity of the network security rule responsible for allowing or denying the traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Is it best practice to assign a NSG to the interface of a resource and another NSG to the subnet/network that resource belongs in?

A

No; Recommended to associate a NSG to a subnet, or a network interface, but not both.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Describe the purpose of an ‘Application Security Group (ASG)’

A

Group identical/similar virtual machines and define security rules based on those groups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What should be considered when assigning network interfaces to an application security group with respect to each interfaces original network?

A

All network interfaces assigned to an ASG have to exist in the same virtual network that the first network interface assigned to the application security group is in.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What must be considered if placing an ASG as the source and destination in a security rule?

A

The network interfaces in both application security groups must exist in the same virtual network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How many route tables can a subnet be associated with?

A

0 or 1.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How many subnets can a route table be associated with?

A

0 or more.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Describe ‘User-Defined Routes (UDRs)’

A

Static routes in Azure to override Azure’s default system routes that list the next hop IP in the route.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the 3 options for defining the next hop in a user-defined route?

A
  1. Virtual network appliance
  2. The private IP address of a network interface attached to a virtual machine
  3. The private IP address of an Azure internal load balancer
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the outcome of defining a user-defined route with 0.0.0.0/0 as the address prefix and a next hop type of virtual appliance?

A

This configuration allows the appliance to inspect the traffic and determine whether to forward or drop the traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What protocol must be used when defining a user-defined route to a virtual network gateway?

A

BGP not ExpressRoute.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

When defining a user-defined route, what should be specified to drop the traffic to a destination?

A

By selecting ‘none’ as the destination.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What controls/mechanisms can be specified as the next hop in a user-defined route?

A

Virtual network peering or VirtualNetworkServiceEndpoint.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Can a service tag be specified as the address prefix of a user-defined route?

A

Yes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

By default, is traffic routed between two virtual networks?

A

No; Each virtual network is isolated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Describe ‘Virtual network peering’

A

Connects two Azure virtual networks allowing the resources in each network to communicate as if they are in the same network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How is traffic routed between VMs in a virtual network peering?

A

Routed through the Microsoft backbone infrastructure, through private IP addresses only.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Describe the purpose of a ‘VPN gateway’

A

A specific type of virtual network gateway used to send traffic between an Azure virtual network and an on-prem over the public internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Can a VPN gateway be used to connect two Azure virtual networks?

A

Yes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the best use case for virtual network peering?

A

Cross-region data replication and database failover as well as for strict data policies and want to avoiding traffic over the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the best use case for VPN Gateways?

A

Useful for necessary encryption and scenarios where latency is not important.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Describe a ‘Gateway transit’

A

Allows you to share an ExpressRoute or VPN gateway with all peered virtual networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is the purpose of a gateway transit?

A

To create a transit virtual network that contains your VPN gateway, Network Virtual Appliance, and other shared services and connect virtual peerings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is the max VPN gateways per virtual network?

A

1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

How many virtual peerings can a virtual network support?

A

Up to 500

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

How should encryption be implemented with virtual network peering?

A

Software-level encryption is recommended as it is not natively provided.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

How should encryption be implemented with a VPN gateway?

A

Custom IPsec/IKE policy can be applied to new or existing connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Describe the purpose of implementing a ‘Virtual WAN’

A

Connects on-prem to your resources in Azure over an IPsec/IKE (IKEv1 and IKEv2) VPN connection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What on-prem device should be considered when implementing a virtual WAN?

A

A VPN device located on-premises that has an externally facing public IP address assigned to it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is the PowerShell cmdlet to create a virtual WAN in Azure Virtual Networks?

A

New-AzVirtualWan.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is the function of a hub in a virtual network?

A

A virtual network that can contain gateways for site-to-site, ExpressRoute, or point-to-site functionality.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is the PowerShell cmdlet to create a virtual WAN hub in Azure Virtual Networks?

A

New-AzVirtualHub.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is the PowerShell cmdlet to create a VPN gateway in Azure Virtual Networks?

A

New-AzVpnGateway.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is the purpose of creating a VPN site?

A

Sites contain your on-premises VPN device endpoints and define the connection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

How many site are allowed per virtual hub in a virtual WAN?

A

Up to 1000 per hub.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is the PowerShell cmdlet to create a VPN site in Azure Virtual Networks?

A

New-AzVpnSite.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What 3 parameters must be declared before connecting a VPN site to a hub?

A
  1. virtualWan
  2. vpnGateway
  3. vpnSite
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is the PowerShell cmdlet to connect a VPN site to a hub in Azure Virtual Networks?

A

New-AzVpnConnection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is required after connecting a VPN site to a hub?

A

Connect a virtual network to the virtual hub.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Describe the connection of a ‘Site-to-site VPN’ in Azure virtual networks

A

IPsec/IKE (IKEv1 or IKEv2) VPN tunnel connecting an on-prem site to Azure or another on-prem site.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is the best use case for a Site-to-site VPN?

A

For cross-premises and hybrid configurations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What physical on-prem requirement should be considered when implementing a Site-to-site VPN?

A

Requires a VPN device located on-premises that has a public IP address assigned to it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Describe the connection of a ‘Point-to-site VPN’

A

A secure connection established from the client PC to a virtual network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is the best use case for a Point-to-site VPN?

A

useful for telecommuters who want to connect to Azure VNets from a remote location or small VPN deployments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Do Point-to-site VPNs require an on-prem public IP?

A

No.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Can a Point-to-site VPN share the same gateway as a Site-to-site VPN?

A

Yes; As long as all the configurations for both connections are compatible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What two modes can a VPN gateway be configured in?

A
  1. active-standby mode using one public IP
  2. active-active mode using two public IPs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What must be considered when creating multiple VPN connections from a virtual network gateway?

A

Must use a RouteBased VPN type because each virtual network can only have one VPN gateway.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is required to use site-to-site VPNs and ExpressRoute in the same configuration?

A

Two virtual network gateways for the same virtual network, one using the gateway type ‘Vpn’, and the other using the gateway type ExpressRoute.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Describe ‘Azure ExpressRoute’

A

A direct, private, connection from on-premises WAN into the Microsoft cloud not routed over the internet.

64
Q

What layer 3 protocol does Azure ExpressRoute use to exchange routes between on-prem, and Azure?

A

BGP.

65
Q

How does ExpressRoute ensure redundancy?

A

Two connections to two Microsoft Enterprise edge routers (MSEEs) from the connectivity provider or your network edge.

66
Q

What regions can an ExpressRoute circuit connect to by default?

A

Connectivity to all regions within a geopolitical region.

67
Q

How can an ExpressRoute circuit connect to regions outside a geopolitical boundary?

A

With ExpressRoute Premium.

68
Q

Define ‘ExpressRoute Global Reach’ and its purpose

A

Link ExpressRoute circuits together to make a private network between your on-premises networks.

69
Q

Define ‘ExpressRoute Direct’ and its purpose

A

ExpressRoute directly to a hosted Datacenter.

70
Q

How can encryption be implemented over an ExpressRoute?

A

Deploy Azure Virtual WAN from your on-premises network to Azure over the private peering of an Azure ExpressRoute circuit

71
Q

What two steps should be taken to implement encryption over an ExpressRoute?

A
  1. Establish ExpressRoute connectivity with an ExpressRoute circuit and private peering.
  2. Configure VPN from express route circuit to on-prem WAN.
72
Q

How many routes/paths are associated with a configuration that implements encryption over an ExpressRoute circut?

A

2; One over the IPsec-protected path and one directly over ExpressRoute without IPsec protection

73
Q

What are weak points for the PaaS cloud service model that bad actors go after?

A

Admin access and application code

74
Q

What is best practice for connecting to hybrid PaaS and IaaS services?

A

By using a management interface.

75
Q

Describe ‘Azure Network Watcher’

A

Enables you to monitor and repair the network health of IaaS products.

76
Q

Describe ‘IP flow verify’ and its purpose

A

Network watcher tool; Detect traffic filtering issues at a virtual machine level.

77
Q

Describe ‘NSG diagnostics’ and its purpose

A

Network watcher tool; Detect traffic filtering issues at a virtual machine, virtual machine scale set, or application gateway level.

78
Q

Describe ‘Next hop diagnostics’ and its purpose

A

Network watcher tool; Detect routing issues and checks if traffic is routed correctly to the intended destination.

79
Q

Describe ‘Effective security rules’ and its purpose

A

Network watcher tool; Shows you all security rules applied to the network interface, the subnet the network interface is in, and the aggregate of both.

80
Q

Describe ‘Connection troubleshoot’ and its purpose

A

Network watcher tool; Test a connection between a virtual resource and another IP or URL.

81
Q

What are the two traffic monitoring tools that Network watcher offers?

A
  1. Flow logs
  2. Traffic analytics
82
Q

Describe Network Watcher Flow logs

A

Log information about IP traffic flowing through a network security group.

83
Q

Where is log data captured by flow logs stored?

A

Azure storage.

84
Q

A company wants to establish network topologies that combine cross premises connectivity with inter virtual network connectivity. Which Azure feature allows them to do this

A

VNet peering.

85
Q

Describe a ‘Virtual Network (VNet) service endpoint’

A

Provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network.

86
Q

What is the purpose of a ‘Virtual Network (VNet) service endpoint’

A

Provides the identity of the vnet to the Azure service while virtual network rules secure the Azure services to vnets.

87
Q

How does a Virtual Network (VNet) service endpoint secure traffic?

A

Enables private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet.

88
Q

Can vnet service endpoints function with vnets with a classic deployment?

A

No; Only with vnets deployed through the Azure Resource Manager deployment model.

89
Q

By default, do vnet service endpoints filter between on-prem and Azure services?

A

No; only for intra-subnet traffic.

90
Q

How does vnet service endpoints function with Azure SQL?

A

Service endpoint applies only to Azure service traffic within a virtual network’s region.

91
Q

What occurs after enabling a service endpoint?

A

IPs switch from public to private and any existing open TCP connections are closed.

92
Q

How can vnet service endpoints be deployed to filter traffic between a vnet and an Azure service?

A

VNet service endpoint policies.

93
Q

Do vnet service endpoints affect disk traffic from an Azure FM?

A

No.

94
Q

Describe a ‘private endpoint’

A

A special network interface for an Azure service that uses a private IP address from a vnet.

95
Q

What is the purpose of a private endpoint?

A

Secures traffic to a service.

96
Q

What services can implement a private endpoint?

A

Azure Storage
Azure Cosmos DB
Azure SQL Database

97
Q

How do private endpoints route/filter traffic?

A

Traffic is secured to a private-link resource and validates network connections, allowing only those that reach the specified private-link resource.

98
Q

When deploying a private endpoint, what should be considered in regards to its region/location?

A

The private endpoint must be deployed in the same region and subscription as the virtual network.

99
Q

Can the private link resource and the vnet/private endpoint be deployed in different regions?

A

Yes.

100
Q

Can multiple private endpoints be created deployed to the same private-link resource?

A

Yes.

101
Q

What are the two ways of allowing access to a private-link resource?

A
  1. Automatically approve
  2. Manually request
102
Q

Describe the Azure private link service

A

Allows an external user to have a private connection to an Azure service behind a standard load balancer through a private endpoint deployed in the external users vnet.

103
Q

When deploying a private link service, what must be considered when choosing region/location?

A

Private Link Service must be deployed in the same region as the virtual network and the Standard Load Balancer.

104
Q

How can multiple private link resources be created on the same standard load balancer?

A

By using different front-end IP configurations for each private link.

105
Q

What is the purpose of the virtual network integration feature in Azure app service?

A

Gives compute app services access to resources in your virtual network and make outbound calls from your app into your virtual network.

106
Q

What does virtual network integrations provide for an app service?

A

Network security groups (NSGs); route tables/UDRs; NAT gateways.

107
Q

How many virtual network integrations can a single app service have?

A

2

108
Q

What are the 3 ways to route traffic when implementing a virtual network integration with an app service?

A
  1. Application routing
  2. Configuration routing
  3. Network routing
109
Q

A company wants to route traffic for their custom containers through virtual network integration. What must they ensure is configured in addition to the routing setting?

A

Any firewall or Network Security Group configured on traffic from the subnet allow traffic to port 443 and 445.

110
Q

Describe client-side encryption

A

Data encrypted by an application that’s running outside of Azure or data pre-encrypted when received by Azure.

111
Q

Who handles encryption/decryption with client-side encryption?

A

Only the client has access to the encryption keys and can decrypt this data.

112
Q

What are the 3 types of server-side encryption models?

A
  1. Service-managed keys
  2. Customer-managed keys
  3. Service-managed keys in customer-controlled hardware
113
Q

Describe ‘Service-managed keys in customer-controlled hardware’ server-side encryption

A

Host Your Own Key (HYOK); Enables you to manage keys in your proprietary repository, outside of Microsoft control.

114
Q

What are the two options in Azure for disk encryption?

A
  1. Disk Encryption for Linux VMs, using Device Mapper (DM)-Crypt
  2. Disk Encryption for Windows VMs, which uses Windows BitLocker
115
Q

What service automatically encrypts and decrypts data stored in Blob storage or Azure files?

A

Azure Storage Service Encryption (SSE).

116
Q

What algorithm does Azure Storage Service Encryption (SSE) use to encrypt data?

A

AES-256 bit.

117
Q

What is the function of Transparent Data Encryption (TDE)?

A

Used to encrypt SQL Server, Azure SQL Database, and Azure Synapse Analytics data files in real time, using a Database Encryption Key (DEK).

118
Q

How does Transparent Data Encryption (TDE) encrypt/decrypt database data?

A

Using AES and 3DES to encrypt at the page level before they are written to disk, and decrypt before they are read into memory.

119
Q

Describe the ‘Always Encrypted feature’

A

Feature of Azure SQL that encrypts data within client applications prior to storing it in Azure SQL Database.

120
Q

Can the ‘Always Encrypted feature’ be used with client-side encryption?

A

Yes; Enable delegation of on-premises database administration to third parties.

121
Q

Describe ‘Cell-level or column-level encryption (CLE)’

A

Encrypt specific columns or even specific cells of data with different encryption keys in Azure SQL Database.

122
Q

How does Cell-level or column-level encryption (CLE) encrypt/decrypt data at rest?

A

Symmetric encryption to a column of data by using Transact-SQL.

123
Q

How is encryption at rest implemented with Azure Cosmos DB?

A

Enabled by default and can’t be turned off.

124
Q

What are the 3 types of keys that are used in encrypting and decrypting data at rest?

A
  1. Master Encryption Key (MEK)
  2. Data Encryption Key (DEK)
  3. Block Encryption Key (BEK)
125
Q

Describe the purpose/function of the Master Encryption Key (MEK)?

A

Used to encrypt the DEK.

126
Q

Describe the purpose/function of the Block Encryption Key (BEK)?

A

Derived from the DEK and the data block.

127
Q

How is data encrypted in transit between Azure data centers?

A

Data-link layer encryption method using the IEEE 802.1AE MAC Security Standards (MACsec) integrated into the network hardware.

128
Q

How can encrypted access be implemented with Azure storage besides HTTPS?

A

SMB 3.0 or Shared Access Signatures (SAS)

129
Q

Describe ‘Azure Firewall’

A

Cloud-native stateful network firewall.

130
Q

What the 3 SKU tiers available for Azure Firewall?

A

Standard, Premium, and Basic.

131
Q

Describe Azure Firewall standard

A

Provides layer 3 to layer 7 (L3-L7) filtering and threat intelligence feeds directly from Microsoft Cyber Security.

132
Q

Describe Azure Firewall premium

A

Includes signature based IDS and IPS.

133
Q

Describe Azure Firewall basic

A

Threat Intel alert mode only; Fixed scale unit to run the service on two VMs.

134
Q

Which Azure Firewall SKU is best for small to medium businesses?

A

Basic; Recommended for environments with an estimated throughput of 250 Mbps.

135
Q

Describe the purpose of ‘Azure Firewall Manager’

A

Centrally deploy, configure, and apply polices to multiple Azure Firewall instances.

136
Q

Which two network architecture types can Firewall Manager provide security management for?

A
  1. Secured virtual hub
  2. Hub virtual network
137
Q

Describe a ‘Secured virtual hub’

A

A Microsoft-managed hub that has associated security and routing policies.

138
Q

Describe a ‘Hub virtual network’

A

Standard Azure virtual network that you create and manage yourself associated with security and routing policies.

139
Q

Which network architecture type can integrate with a 3rd party security as a service (SECaaS) provider?

A

Secured virtual hub.

140
Q

Are Web Application Firewalls (WAFs) able to be managed by Azure Firewall Manager?

A

Yes.

141
Q

Describe an ‘Azure Application Gateway’

A

A web traffic (OSI layer 7) load balancer.

142
Q

Describe a ‘listener’

A

A logical entity that checks for incoming connection requests to an application gateway’s frontend IP.

143
Q

How does a listener determine if it should accept an incoming request?

A

If the protocol, port, hostname, and IP address associated with the request match the same elements associated with the listener configuration.

144
Q

What are the two ways to create a routing rule to the backend pool for an application gateway?

A
  1. Basic - forwards normally to a pool
  2. Path based; route requests from specific URL paths to specific backend pools
145
Q

When implementing an application gateway, how can HTTP traffic be rerouted to HTTPS?

A

Choose listener as the redirection target; Redirects traffic from the source listener that checks for HTTP requests to the destination listener that checks for HTTPS.

146
Q

Define ‘Connection draining’

A

Helps you gracefully remove backend pool members during planned service updates.

147
Q

How does connection draining function?

A

Ensures that all deregistering instances in a backend pool don’t receive any new requests/connections while maintaining the existing connections until the configured timeout value.

148
Q

How is a WAF implemented on an Application Gateway?

A

Create a WAF policy and associate it with an application Gateway.

149
Q

What are the two modes of configuring an Application Gateway WAF?

A
  1. Detection mode
  2. Prevention mode
150
Q

What is the purpose/function of a ‘WAF engine’?

A

Inspects traffic and determines whether a request includes a signature that represents a potential attack.

151
Q

Describe ‘Anomaly Scoring mode’

A

Traffic that matches any rule isn’t immediately blocked when the firewall is in Prevention mode, it will depend on the anomaly score threshold.

152
Q

What actions does an Azure WAF support?

A
  1. Allow
  2. Block
  3. Log
  4. Anomaly score
153
Q

Describe ‘Azure Front Door’

A

A cloud Content Delivery Network (CDN) using Microsoft’s global edge network to distribute content to one of hundreds of global and local points of presence (PoPs).

154
Q

Describe ‘Azure DDoS Protection’

A

Protects at layer 3 and layer 4 network layers to mitigate DDoS.

155
Q

What are the two tiers/SKUs of Azure DDoS Protection?

A
  1. DDoS Network Protection
  2. DDoS IP Protection
156
Q

How is Azure DDoS Protection priced?

A

Only one license that can span across multipole subscriptions for DDoS Network Protection and DDoS IP Protection is pay-per-protected IP.

Microsoft Azure Security Engineer (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions