Security and Networking Flashcards
What is Azure Security Center?
A monitoring service that provides visibility across all of your services, both on Azure and on-premises, into your cybersecurity policies and controls, as well as how well you can predict, prevent, and respond to security threats
How can you prevent malware from being installed on your VMs?
You can use Azure Security Center to either use machine learning to detect and block malware or adaptive application controls to define rules that ensure only allowed applications can run
What are some of Security Center’s advanced cloud defense capabilities?
Just-in-time VM access, Adaptive application controls, Adaptive network hardening, File integrity monitoring
What is Azure Sentinel?
A cloud-based security information and event management (SIEM) system which uses intelligent security analytics and threat analysis
What is Azure Key Vault?
A centralized cloud service for storing an application’s secrets in a single location
What is a host group?
A collection of dedicated physical servers provided by Azure Dedicated Host
What’s the easiest way for Tailwind Traders to combine security data from all of its monitoring tools into a single report?
Collect security data in Azure Sentinel
What is the best way for Tailwind Traders to safely store its TLS certificates so that they’re accessible to cloud VMs?
Store the certificates in Azure Key Vault
How can you ensure that certain VM workloads are physically isolated from workloads being run by other customers?
Run the VMs on Azure Dedicated Host
What is defense in depth?
A strategy of providing security on many layers to remove reliance on any single layer of protection
Give an overview of each layer that defense in depth is concerned with?
- Physical Security layer is the first line of defenses to protect computing hardware
- Identity and Access layer controls access to infrastructure and change control
- Perimeter layer uses DDoS protection to filter large-scale attacks
- Network layer limits communication between resources through segmentation and access controls
- Compute layer secures access to virtual machines
- Application layer helps ensure that applications are secure and free of security vulnerabilities
- Data layer controls access to business and customer data that you need to protect
What are the common principles to define a security posture?
- Confidentiality - use the principle of least privilege
- Integrity - Prevent unauthorized changes to information both when stored and in transit
- Availability - Ensure services are functioning and can be accessed only by authorized users
What can you configure with Azure Firewall?
- Application rules that define fully qualified domain names (FQDNs) that can be accessed from a subnet
- Network rules that define source address, protocol, destination port, and destination address
- Network Address Translation (NAT) rules that define destination IP addresses and ports to translate inbound requests
What kind of attacks can Azure DDoS Protection help prevent?
- Volumetric attacks that flood the network layer with seemingly legitimate traffic
- Protocol attacks that render a target inaccessible by exploiting a weakness in the networking (IP) and transport (TCP) layers of the protocol stack
- Resource-layer (application-layer) attacks that target web application packets to disrupt the transmission of data between hosts. A Web Application Firewall (WAF) is required to protect against L7 attacks.
What are network security groups?
NSGs act like an internal firewall and enable you to filter network traffic to and from Azure resources within an Azure virtual network.
What is Web Application Firewall?
WAF is a feature of Azure Application Gateway that provides your web applications with centralized, inbound protection against common exploits and vulnerabilities
