Security

Question 1

Describe Azure NSGs and NSG rules.

Answer 1

NSGs are applied to VNets or subnets.

Creating inbound and outbound rules allows the user to filter traffic to the resources in the Vnet / Subnet.

Each rule has a name, priority, source/destinatinon (IP), protocol, direction, port range, and action (allow/deny)

Question 2

What is the relationship between NSGs and VNets/subnets.

Answer 2

A vnet/subnet has 0 or 1 NSGs

An NSG can be applied to as many Vnets/subnets as desired.

Question 3

Describe Azure DDoS Protection

Answer 3

Azure DDoS protections protects against DDoS attacks (volumetric, application, and protocol attacks).

Basic and Standard tiers. Standard provides enhanced protection for VNet resources.

Question 4

Describe Azure Firewall and its key features.

Answer 4

Managed cloud firewall to protect your VNet resources.

• Built-in HA
• Network and application level filtering
• SNAT / DNAT to communicate with internet
• multiple public IPs
• threat intelligence
• Azure Monitor integration for logs.

Question 5

Describe Azure Bastion and its key features.

Answer 5

Managed service that allows RDP / SSH access to VMs in VNets securely over TLS without having to expose/open ports.

• Can access VM in same Vnet or peered VNet.

Question 6

Describe Azure Web Application Firewall.

Answer 6

Managed web app firewall that protects against known exploits and vulnerabilities (e.g. SQL injection or cross-site scripting).

Can be deployed with

• Azure Front Door
• Azure Application Gateway
• Azure CDN

Question 7

Describe data encryption in Azure

Answer 7

• Storage Service Encryption (Azure Storage Accounts)
• Azure Disk Encryption (bitlocker for windows, dm-crypt for linux)
• Transparent Data Encryption (SQL DB and Synapse SQL Pools)

Question 8

Describe Key Vault

Answer 8

Centralised service for storing application secrets, keys, and certificates.

Question 9

Describe the principles of cloud security posture management.

Answer 9

To identify and prioritise the remediation of security risks through assessment checks and automated compliance monitoring.

Question 10

Describe Microsoft Defender for Cloud and its key features.

Answer 10

Microsoft’s CPSM tool. Enables continuous assessment of security posture, hardening guidance, and threats detection/resolution.

• Secure score, Network Map, Cloud Workload Protection plans.(e.g. Defender for Servers, Defender for App Service, etc.)

Question 11

Describe the Microsoft Defender for Cloud tiers and features.

Answer 11

Two tiers:
- Free and Enhanced Security Features.

Features of Enhanced tier:

• Protection for other cloud and hybrid.
• Vulnerability scanning (VMs and container registries)
• Track compliance against a range of standards.
• Access and application controls
• Threat protection alerts and Defender for Endpoint.

Question 12

Describe Azure Security Baselines.

Answer 12

Each Azure service has a service baseline.

The baseline consists of service controls that contains recommendations, guidance, and responsibility.

Question 13

Describe SIEM, SOAR, and XDR.

Answer 13

SIEM = security information event management
SOAR = security orchestration automated response
XDR = eXtended detection and response

Question 14

Describe Microsoft Sentinel and its integrated threat protection capabilities.

Answer 14

Cloud native SIEM / SOAR solution.

• Connect to your services and ingest security data via connectors
• Analyse with Workbooks (Azure Monitor integration)
• Manage incidents
• SOAR playbooks (Azure Logic Apps)
• Hunting and Investigation capabilities
• integration with Defender for Cloud and Defender 365.

Two pricing models: Capacity reservation or Pay-as-you-go.

Question 15

Describe the services of Microsoft 365 Defender.

Answer 15

It’s an enterprise defense suite with four main component services:

• Defender for Office 365. (safeguards threats from email, links, collaboration tools.)
• Defender for Endpoint. (protects against threats to endpoints. Asset discovery, vuln mgmt, attack surface reduction rules, antivirus, threat analytics and hunting, remediation automation, )
• Defender for Cloud Apps. (Cloud access security broker - gives visibility, threat protection, data security, and compliance to cloud apps.)
• Defender for Identity. (protect against id threats, compromised ids, and malicious insider actions.)

Brings these together in the Microsoft Defender 365 portal.

Question 16

Describe JIT access

Answer 16

Allows lockdown of inbound traffic to VMs using Microsoft Defender for Cloud control of Firewalls and NSGs.

User can request access foe selected port and ip range for a specified amount of time. Afterwards D for C restores Firewalls and NSGs to previous states.