Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Learning items > Security theory > Flashcards

Security theory Flashcards

1
Q

What is MIG?

A

Microsoft Information Governance (MIG) is a collection of features to govern your data for compliance or regulations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the difference between Retention Policies and RM?

A

While Records Management (RM) leverages Retention Policies, they perform differently.

Retention labels keep a copy of the content hidden from the user (but they can still delete/modify content from the UI), but RM blocks actions in the UI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

6 Pillars of Zero Trust

A
  • Identities must be verified
  • Devices create a large attack surface needing monitoring
  • Applications (inc Shadow IT) must be mapped & protected
  • Data must be classified, encrypted & labelled
  • Infrastructure must be monitored
  • Networks need segmenting, encryption & monitoring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the THREE features you can configure to provide automated Data classification?

A

Trainable classifiers
Sensitive Information Types
Exact Data Matches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Sensitivity labels are an example of Data classification. List THREE other areas.

A
  • (Sensitivity labels)
  • Retention policies
  • Communication compliance
  • Insider risk management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What FOUR actions can you view with the activity explorer?

A
  • Read
  • Deletion
  • Printed
  • Copied to network share/USB
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

True/False: Azure Active Directory (Azure AD) Identity Protection can be used to invoke Multi-Factor Authentication based on a user’s risk level

A

True. CA is a feature provided by Identity Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Hot Area:

Answer Area
______ can use conditional access policies to control sessions in real time.

  • Azure Active Directory (Azure AD) Privileged - Identity Management (PIM)
  • Azure Defender
  • Azure Sentinel
  • Microsoft Cloud App Security
A

Cloud App Security /
MS Defender for Cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How many trainable classifiers and specific file extensions can be applied to a single Insider Risk Policy?

A

5 classifiers / 50 file extensions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a Sequence, in regards to Insider Risk Management?

A

A sequence is a group of two or more potentially risky activities performed one after the other that might suggest an elevated risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What FOUR categories of activity could trigger alerts for the Data leaks by the priority users sequence?

A
  • Collection eg. downloading files from SharePoint sites or moving files into a compressed folder.
  • Obfuscation eg. renaming files on a device.
  • Exfiltration eg. sending emails with attachments outside of your organisation.
  • Clean-up eg. deleting files from a device.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What’s required for an organisation to use Peer groups for cumulative exfiltration detection?

A

Your organisation agrees to share Azure AD data with the compliance portal, including organisation hierarchy and job titles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What data is typically contained in a security token (claim)?

A

Issuer
Audience
Expiry/Issued at/Not valid before
Subject
OID/TID
Name
Signature

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What tech is the MS ID platform built on?

A

OpenID Connect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How does Peer groups for cumulative exfiltration detection work?

A

It looks for peers outside the organisation, based on the following criteria:

  • SharePoint sites: Insider risk management identifies peer groups based on users who access similar SharePoint sites.
  • Similar organization: Users with reports and team members based on organization hierarchy.
  • Similar job title: Users with a combination of organizational distance and similar job titles.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What TWO secondary authentication TYPES are supported in AAD?

A

OAuth software/hardware, voice-call verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What SIX authentication methods are available for SSPR?

A
  • Mobile app notification
  • Mobile app code
  • Mobile phone
  • Office phone
  • Email
  • Security questions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What licence is required to allow banned password lists?

A

Banned password lists are a feature of Azure AD Premium P1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What licence is required to allow PIM?

A

Azure AD Premium P2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

True/False: NSGs can deny inbound traffic from the Internet

A

TRUE, NSGs deny all in-bound Internet Traffic by default.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What’s an Access Package?

A

A group of access entitlements needed to fulfil a specific role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What licence is needed to allow Entitlement Management?

A

Azure AD Premium P2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What licence is needed to allow Access Reviews?

A

Azure Ad Premium P2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What THREE secondary authentication TECHNOLOGIES are supported in AAD?

A

Authenticator
Hello for Business
FIDO 2 keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What THREE services does Azure Identity Protection (AIP) provide?

A
  • Automate the detection and remediation of identity-based risks.
  • Investigate risks using data in the portal.
  • Export risk detection data to third-party utilities for further analysis
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is Sign-in risk in AIP?

A

The probability that a given authentication request isn’t authorized by the identity owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What SIX sign-in risks can AIP detect?

A

Anonymous IP address.
Malware linked IP address.
Atypical travel.
Unfamiliar sign-in properties.
Password spray.
Azure AD threat intelligence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is User risk in AIP?

A

The probability that a given identity or account is compromised

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are TWO user risks that AIP can detect?

A

Leaked credentials.
Azure Ad Threat Intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What THREE reports are produced by AIP?

A

Risky users
Risky sign-ins
Risk detections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What licence is needed to allow Azure Identity Protection?

A

Azure AD Premium P2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Your organization has implemented important changes in their customer facing web-based applications. You want to ensure that any user who wishes to access these applications agrees to the legal disclaimers. Which Azure AD feature should you implement?

A

Azure AD Terms of Use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

An organization is project-oriented with employees often working on more than one project at a time. Which solution is best suited to managing user access to this organization’s resources?

A

Entitlement management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

An organization has recently conducted a security audit and found that four people who have left were still active and assigned global admin roles. The users have now been deleted but the IT organization has been asked to recommend a solution to prevent a similar security lapse happening in future. Which solution should they recommend?

A

PIM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What TWO licences allow use of Dynamic groups in AAD?

A

Azure AD Premium P1
Intune for Education

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are three types of DDOS attack?

A

Volumetric attacks: that flood the network with seemingly legitimate traffic, overwhelming the available bandwidth.

Protocol attacks: Protocol attacks render a target inaccessible by exhausting server resources with false protocol requests that exploit weaknesses in layer 3 (network) and layer 4 (transport) protocols.

Resource (application) layer attacks: These attacks target web application packets, to disrupt the transmission of data between hosts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What three TIERS of Azure DDoS protection are available?

A

Basic (now renamed Default)
DDoS Network Protection (SKU)
DDoS IP Protection (preview)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

True/False: By default, NSGs allow outbound traffic to access the Internet

A

True, unless specifically over-ridden by a higher-priority rule.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Describe use of Threat Intelligence with respect to Azure Firewall

A

Threat intelligence-based filtering can be enabled for your firewall to alert and deny traffic from/to known malicious IP addresses and domains

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Describe FOUR advantages of Azure Firewall

A

Built-in high availability and availability zones

Outbound SNAT and inbound DNAT to communicate with internet resources

Threat intelligence

Integration with Azure Monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Describe WAF

A

Web Application Firewall provides centralised protection of your web applications from common exploits and vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

True/False: NSGs block incoming Internet Traffic by default?

A

Communication needs to be explicitly provisioned enables more control over how Azure resources in a VNet communicate with other Azure resources, the internet, and on-premises networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

True/False: You can associate multiple NSGs to VNet subnets or NICs?

A

False -You can associate only one network security group to each virtual network subnet and network interface in a virtual machine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

True/False: You can associate an NSG with multiple subnets & NICs

A

True -The same network security group can be associated to as many different subnets and network interfaces as you choose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Intune is managed via:
- AAD Admin Centre
- M365 Compliance Centre
- M365 Security Centre
- Endpoint Admin Centre

A

Microsoft Endpoint Admin Centre

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What THREE Inbound security rules are provided in NSGs by default?

A

AllowVNetInBound. This rule allows traffic from any Virtual Network (as defined by the service tag) on any port to any Virtual Network on any port, using any protocol.

AllowAzureLoadBalancerInBound. This rule allows traffic from any Azure Load Balancer on any port to any IP address on any port, using any protocol.

DenyAllInBound rule.
This rule denies all traffic from any source IP address on any port to any other IP address on any port, using any protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is the difference between Network Security Groups (NSGs) and Azure Firewall?

A

NSGs provide traffic filtering to limit traffic WITHIN VNets in each subscription.

Azure Firewall provides protection ACROSS different subscriptions and VNets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

True/False: Intune can be used to provision Azure subscriptions?

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

How widely does Bastion protect your VMs, VNets and subscriptions?

A

Bastion provides secure RDP and SSH connectivity to all VMs in the VNet, and peered VNets, in which it’s provisioned.

Bastion deployment is per VNet, not per subscription/account or virtual machine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

True/False: VMs accessed via Bastion need Public IPs

A

False. Bastion opens the RDP/SSH connection to your Azure virtual machine using private IP on your VM. You don’t need a public IP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

True/False: The Bastion service eliminates the need for NSGs

A

True -The service is hardened internally to provide secure RDP/SSH connectivity. You don’t need to apply any NSGs on an Azure Bastion subnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

True/False: The Bastion service does NOT eliminate the need to harden VMs

A

False -Because it sits at the perimeter of your virtual network, you don’t need to worry about hardening each virtual machine in the virtual network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

How does JIT protect VMs?

A

JIT allows you to select VM ports to which inbound traffic is blocked.

Defender for Cloud places “deny all inbound traffic” rules for these ports in the NSG/Firewall rules.

Defender applies RBAC to allow blocking to be lifted for a specified time & restores it afterwards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

True/False: JIT for VMs requires a Defender for Cloud subscription

A

True -JIT requires Microsoft Defender for servers to be enabled on the subscription

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

True/False: When JIT VM access expires, the connection is dropped

A

False -Defender for Cloud restores the NSGs to their previous states. Connections that are already established are not interrupted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

List THREE types of data encryption provided by Azure

A

Storage encryption (managed disks, blob storage, files & queues)
Disk encryption Win/Linux VM disks (bitlocker/dm-crypt)
Transparent Data Encryption (TDE) in SQL Db & Data Warehouse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

List FOUR functions of Azure Key Vault

A

Secrets Mgmt (control access)
Key Mgmt
Cert Mgmt
Hardware Security Module (HSM) (store secrets in FIPS 140-2 HSMs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

The security admin wants to protect Azure resources from DDoS attacks and needs logging, alerting, and telemetry capabilities. which Azure service can provide these capabilities?

  • Default DDoS infrastructure protection.
  • Both DDoS IP Protection and DDoS Network Protection.
  • Azure Bastion.
A

DDoS IP Protection and DDoS Network Protection provide advanced capabilities, including logging, alerting, and telemetry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Expand CSPM

A

Cloud Security Posture Management assesses systems and alerts security staff when a vulnerability is found.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Expand TVM

A

Threat & Vulnerability Management provides a holistic view of the organization’s attack surface and risk and integrates it into operations and engineering decision-making

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Expand CWP

A

Cloud Workload Protection

Through CWP, Defender for Cloud is able to detect and resolve threats to resources, workloads, and services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

An organization wants to add vulnerability scanning for its Azure resources to view, investigate, and remediate the findings directly within Microsoft Defender for Cloud. What functionality would they need to consider?

  • Secure score and recommendations functionality that is part of the CSPM pillar of Defender.
  • The enhanced functionality that is provided through the Microsoft Defender plans and is part of the CWP pillar of Defender.
  • Security Benchmarks.
A

2 Microsoft Defender plans provide enhanced security features for your workloads, including vulnerability scanning.

The Microsoft cloud security benchmark (MCSB) provides prescriptive best practices and recommendations, NOT vulnerability scanning.

63
Q

List THREE deliverables
provided by the Purview Governance Portal

A
  • Create a holistic, up-to-date map of your data landscape with automated data discovery, sensitive data classification, and end-to-end data lineage.
  • Enable data curators to manage and secure your data estate.
  • Empower data consumers to find valuable, trustworthy data.
64
Q

What functionality is provided by the Purview Data Map?

A

By scanning registered data sources, Azure Purview Data Map is able to capture metadata about enterprise data, to identify and classify sensitive data.

65
Q

What services are provided by the Purview Data Catalogue?

A

Users can quickly and easily find relevant data using a search with filters based on various lenses like glossary terms, classifications, sensitivity labels etc.

66
Q

What THREE insights are provided by Purview Data Estate Insights?

A

Data and security officers can get a bird’s eye view and at a glance understand:
- What data is actively scanned
- Where sensitive data is
- How it moves.

67
Q

What functionality is provided by the Purview Data Sharing & Data Policy (Preview)?

A

Access policies in Purview enable you to manage access to different data systems across your entire data estate.
Eg. if a user needs read access to an Azure Storage account that has been registered in Purview, you can grant this access directly from Purview.

68
Q

Which application in the Purview governance portal is used to capture metadata about enterprise data, to identify and classify sensitive data?

  • Data Catalog
  • Data Map
  • Data Estate Insights.
A

2 Purview Data Map captures metadata about enterprise data, to identify and classify sensitive data.

69
Q

What are the FOUR stages of Data Lifecycle Management?

A
  • Know your data (ID important data)
  • Protect your data (encrypt, restrict)
  • Prevent data loss (oversharing)
  • Govern your data (retention/mgmt policies)
70
Q

What THREE data classification methods are used by Purview?

A
  • Manual
  • Auto pattern recognition
  • Machine learning
71
Q

What are Sensitive Information Types?

A

Sensitive information types (SIT) are pattern-based classifiers. They have set patterns that can be used to identify them.
Eg. credit card/bank account/passport numbers.

72
Q

What is Exact Data Match (EDM) classification?

A

EDM-based classification enables you to create custom sensitive information types that refer to exact values in a database of sensitive information.

73
Q

What are Trainable Classifiers?

A

Trainable classifiers use AI to intelligently classify data. They’re most useful classifying data unique to an organization like specific kinds of contracts, invoices, or customer records.

74
Q

What TWO types of Trainable Classifier are available in Purview?

A
  • Pre-trained (source code/resumes/threats/profanity)
  • Custom (specific contracts/invoices/records)
75
Q

Define “Seeding”

A

Training a custom trainable classifier by presenting many samples of example content.

76
Q

What does the Content Explorer do?

A

Enable admins to view content that has been summarised in the overview pane.

77
Q

What TWO roles have access to Purview’s Content Explorer?

A
  • Content explorer list viewer.
  • Content explorer content viewer.

(List view shows matching objects, content enables viewing them).

78
Q

List FOUR activities associated with a labelled document that can be analysed by Purview’s Activity Explorer

A
  • File copied to removable media
  • File copied to network share
  • Label applied
  • Label changed
79
Q

List THREE properties of Labels

A
  • Customizable. Admins can create different categories specific to the organization.
  • Clear text. Each label is stored in clear text in the content’s metadata, third-party apps and services can read it and then apply their own protective actions, if necessary.
  • Persistent. After you apply a sensitivity label to content, the label is stored in the metadata of that email or document & moves with the content.
80
Q

True/False: Labels cab be used to protect content in containers such as sites and groups.

A

True This doesn’t result in documents being automatically labeled. Instead, the label settings protect content by controlling access to the container where documents are stored.

81
Q

True/False: Multiple labels may be applied to one document or email

A

False Only one label can apply in each case.

82
Q

True/False: Labels may mark content, encrypt it or do nothing

A

True Labels can:
- Display watermarks
- Encrypt emails and/or documents
- Do nothing other than act as a classification

83
Q

Why would labels be used without protective restrictions?

A

The label classification can be used to generate usage reports and view activity data for sensitive content.

84
Q

True/False: Labels may be used to link users to custom help pages.

A

True It helps users to understand what the different labels mean and how they should be used.

85
Q

What is endpoint data loss prevention?

A

Endpoint data loss prevention (Endpoint DLP) extends the activity monitoring and protection capabilities of DLP to sensitive items that are physically stored on Windows 10, Windows 11, and macOS (Catalina 10.15 and higher) devices

86
Q

How do retention labels and assigning retention policies help organizations?

(List THREE factors)

A
  • Comply proactively with industry regulations and internal policies that require content to be kept for a minimum time.
  • Reduce risk when there’s litigation or a security breach by permanently deleting old content that the organisation is no longer required to keep.
  • Ensure users work only with content that’s current and relevant to them. When content has retention settings assigned to it, that content remains in its original location.
87
Q

True/False: A user CANNOT delete or modify a document managed by a retention policy

A

False People can continue to work with their documents or mail as if nothing’s changed. If they edit or delete retained content, a copy is made in a secure location.

In most cases, people don’t even need to know that their content is subject to retention settings.

88
Q

What FIVE MS products support data retention?

A

SharePoint
OneDrive
Microsoft Teams
Yammer
Exchange

89
Q

What THREE things happen to content when it’s labeled as a record?

A
  • Restrictions are put in place to block certain activities.
  • Activities are logged.
  • Proof of disposal is kept at the end of the retention period.
90
Q

What TWO additional restrictions are placed on Regulatory Records?

A
  • A regulatory label can’t be removed when an item has been marked as a regulatory record.
  • The retention periods can’t be made shorter after the label has been applied.
91
Q

What are four FEATURES/SELLING POINTS of Azure Insider Risk Management?

A
  • Transparency: Balance user privacy versus organisation risk with privacy-by-design architecture.
  • Integrated: Integrated workflow across Microsoft Purview solutions.
  • Configurable: Configurable policies based on industry, geographical, and business groups.
  • Actionable: Provides insights to enable user notifications, data investigations, and user investigations.
92
Q

What FIVE steps comprise the Insider Risk workflow?

A
  • Policies
  • Alerts
  • Triage
  • Investigation
  • Action
93
Q

What THREE eDiscovery solutions are provided with Purview?

A
  • Content search
  • eDiscovery (Standard)
  • eDiscovery (Premium)
94
Q

What additional FIVE services are provided by eDiscovery (Premium)?

A
  • Workflow (identify, preserve, collect review, analyse & export)
  • Manage Custodians
  • Use Review Sets to focus on content
  • Tag relevant content
  • Use AI to further narrow search scopes
95
Q

What additional FOUR services are provided by Purview Audit (Premium)?

A
  • Retention beyond 90 days
  • Customise retention periods
  • Provides records for crucial events
  • Higher bandwidth access to API
95
Q

How long does it take for Purview Audit to log an event?

A

It can take anywhere from 30 minutes to 24 hours for the corresponding audit log record to be returned in the results of a search.

96
Q

What roles are required to access Audit services?

A

View-Only Audit Logs or Audit Logs role in Exchange Online to search the audit log.

By default, these roles are assigned to the Compliance Management & Organisation Management role groups on the Permissions page in the Exchange admin centre.

97
Q

How does a digital signature work?

A

A signed document is hashed, and the hash encrypted with the user’s private key.
The recipient decrypts the hash & checks it against the document’s contents.

98
Q

What is Credential stuffing?

A

Re-using a password in multiple sites/instances

99
Q

What is pretexting?

A

Gaining a victim’s trust to extract secure info, such as generating a fantasy pop star name from the name of a first pet and the place they were born.

100
Q

What feature in Microsoft Defender for Endpoint provides the first line of defense against cyberthreats by reducing the attack surface?

A

Network protection

101
Q

Which feature provides the extended detection and response (XDR) capability of Azure Sentinel?

A

Integration with Microsoft 365 Defender

102
Q

True/False: Conditional access policies apply BEFORE first-factor authentication is complete?

A

False

Conditional Access policies apply AFTER first-factor authentication is complete.

103
Q

Conditional access policies can use WHAT SERVICE as a signal that provides the ability to control sessions in real time?

A

Azure Cloud App Security

AKA Defender for cloud

104
Q

Which layer can secure access to VMs either on-prem or in the cloud by closing certain ports?

A

The Compute layer

105
Q

Which authentication method uses a software agent on an on-prem server to provide simple password validation?

A

Pass-through Authentication (PTA)

106
Q

What are Microsoft’s SIX privacy principles?

A
  • Control over privacy
  • Transparency
  • Security
  • Strong Legal protections
  • No content-based targeting
  • Benefits to you
107
Q

What Security Centre tool would you use to continuously monitor the status of your network?

A

Network map

This provides a topology map of your network workloads, allowing you to block unwanted connections.

108
Q

What is the purpose of Perimeter security in the defence in depth approach?

A

DDOS protection

109
Q

Can Azure firewall encrypt traffic?

A

No

110
Q

What’s the max retention period for M365 Audit Logs?

A

10 years

111
Q

Which THREE features are NOT included in the pricing plan for Office 365 apps?

  • Cloud App Discovery
  • Password protection
  • Group Access Management
  • Risk-based Conditional Access
  • MFA
A
  • Cloud Discovery
  • Group Access Management
  • Conditional Access
112
Q

What FOUR AAD editions are available?

A
  • Free
  • Office 365 Apps
  • Premium P1
  • Premium P2
113
Q

List the FOUR AAD Identity types

A
  • User
  • Service Principal (ID for an App)
  • Managed ID (Managed Service Principals)
  • Device
114
Q

What’s the function of Managed Identities?

A

Managed IDs are auto managed in AAD, eliminating the need for Devs to manage credentials. Managed IDs provide identity for apps to connect to Azure Resources at no extra cost.

115
Q

What is a Service Principal used for?

A

A Service principal is an identity for an app.

It’s required to register the app with AAD to integrate its ID and access functions.

116
Q

True/False: Application developers need to manage and protect Service Principal credentials used by their products

A

True.

Managed Identities negate this requirement for supported Azure resources.

117
Q

What licence is needed to use AAD External Identities?

A

AAD Premium P1

118
Q

True/False: AD FS services will be lost if the on-prem DC service fails

A

False -AD FS can be configured to use password hash sync should the on-prem service fail.

119
Q

An organization has completed a full migration to the cloud and has purchased devices for all its employees. All employees sign in to the device through an organizational account configured in Azure AD. Select the option that best describes how these devices are set up in Azure AD.

  • These devices are set up as Azure AD registered.
  • These devices are set up as Azure AD joined.
  • These devices are set up as Hybrid Azure AD joined.
A

AAD Joined. An AAD joined device is joined to AAD through an organizational account, which is then used to sign in to the device. Azure AD joined devices are generally owned by the organization.

120
Q

A developer wants an application to connect to Azure resources that support Azure AD authentication, without having to manage any credentials and without incurring any extra cost. Which option best describes the identity type of the application?

  • Service principal
  • Managed identity
  • Hybrid Identity
A

Managed identities are a type of service principal that are automatically managed in Azure AD and eliminate the need for developers to manage credentials.

121
Q

What’s the max of the NSG priority range?
- 2096
- 3500
- 4000
- 4096
- 4128

A

NSG priorities are in the range 100 to 4096

122
Q

What mode can WAF operate in to avoid affecting live services during testing?

A

Detection mode. Later, it should be switched to Prevention Mode

123
Q

What are FOUR uses of Cloud App Security (Defender for Cloud Apps)?
- Prevent data leaks & limit access to regulated data
- Provide pass-through authentication to on-prem apps
- Provide secure connection to Azure VMs
- Discover & control shadow IT
- Protect sensitive info hosted anywhere in the cloud

A

Everything BUT Provide secure connection to Azure VMs

124
Q

An audit team needs access to crucial events, such as when mail items were accessed, replied to and forwarded. What capability is required?
- Advanced Auditing
- Core Auditing
- Alert policies to generate & view alerts when actions are performed on mail

A

Advanced Auditing is needed to access crucial events.

125
Q

When considering Cloud App Security/Defender for Cloud Apps, what is a key consideration?
- Data security of your entire estate
- Architecture of your entire estate
- Use of Shadow IT across your entire estate

A

Architecture of the estate

126
Q

Settings may have been changed by a user in Teams. What capability is needed to investigate this?
- Turn on MS Teams settings search & ensure you have the right role
- Verify that auditing is enabled & that you have the right role
- Block Teams & ensure you have the appropriate role

A

Verify that auditing is enabled & you have the appropriate role to perform the search.

127
Q

Retention labels can be applied to _______?
- Exchange (all mailboxes), SharePoint, OneDrive
- Exchange & MS 365 Groups
- Exchange, SharePoint, OneDrive & MS 365 Groups

A

Exchange, SharePoint, OneDrive & MS 365 Groups

128
Q

Where does retention policy store copies for SharePoint/OneDrive?

A

Preservation Hold library

129
Q

Where does retention policy store copies for Exchange mailboxes?

A

Recoverable items folder

130
Q

Where does retention policy store copies for Teams & Yammer?

A

SubstrateHolds

131
Q

Insider Risk Management exports alerting data for SIEM via what service?

A

Office 365 Management API integration

132
Q

Where are all data files & emails associated with alert activities captures & displayed?
- Case overview
- User activity
- Content explorer
- Alerts

A

Content Explorer receives copies of alerts

133
Q

What licence is required for Cloud App Discovery to identify Shadow IT?

A

AAD Premium P1

134
Q

How long do content holds need to take effect?

A

Up to 24 hours

135
Q

What service does Sentinel use to store security analytics data?

A

Azure Log Analytics Workspace

136
Q

What EIGHT services are enabled through Azure AD Premium P1

A
  • (Banned) Password Protection
  • External Identities (B2B/B2C)
  • Dynamic Azure AD Groups
  • Cloud App Discovery (Shadow IT)
  • Conditional access
  • Self-service password Reset
  • Microsoft Identity Manager (HR Connect)
  • Azure Terms of Use
137
Q

The Zero-Trust “Limit Blast Radius” principle involves what TWO elements?

A

Use Identity-based segmentation and Least privilege access

ID Segmentation works by restricting access to apps or workloads, based on job role.

138
Q

Which THREE roles can access the Compliance Centre?

A

Global Admin
Compliance Admin
Compliance Data Admin

139
Q

What are the THREE features of Compliance Manager?

A
  • Pre-built/custom assessments for common industry and regional standards
  • Compliance score
  • Step-by-step guidance to help achieve compliance
140
Q

True/False: Conditional access policies can be applied only to users with AAD-joined devices?

A

False. Conditional access can ALSO be applied to AD DS-joined devices (Win 7 onwards).

141
Q

True/False: With AAD Identity Protection, you can force use of MFA during a user sign-in?

A

True. Identity Protection can configure a Conditional Access policy for you that requires MFA, regardless of which modern authentication app you use.

142
Q

Which of the following is NOT an Identity Governance feature in AAD?
- PIM
- Access reviews
- Conditional access
- Entitlement Management

A

Access reviews

143
Q

Which of the following cards is NOT available within the M365 Security Centre?
- Identities
- Devices
- Groups
- Apps

A

Groups

144
Q

Which of the four MCAS pillars is responsible for identifying and controlling sensitive information?
- Visibility
- Threat protection
- Compliance
- Data security

A

Data security

145
Q

True/False: A system-assigned managed identity is created as a standalone Azure resource?

A

False

USER-assigned is stand-alone, system assigned is created as part of a VM or App Service.

146
Q

True/False: Responsibility for Network controls & Host infrastructure is SHARED between MS and users for IaaS solutions?

A

True

147
Q

What is a message digest?

A

An alternative term for a Hash value

148
Q

What are the most common hash lengths in use?
- 256-288
- 128-160
- 512-1024
- 96-1016

A

128-160

149
Q

What feature allows use of the same security key across multiple services?
- Hmac-secret
- Resident key
- Multiple accounts per RP
- Client PIN

A

Multiple accounts per RP (RelyingParty)

150
Q

Which of the following is NOT an identity?
- Services
- Users
- Networks
- Devices

A

Networks

151
Q

True/False: You can only add one resource lock to an Azure resource?

A

False.

You can have ReadOnly & CanNotDelete locks on one resource and resources can inherit locks from parent objects. The most restrictive lock takes precedence.

152
Q

Which of the following is a feature of Defender for Endpoint’s behavioral sensors technology?
- Behavioral signals are translated into insights, detections, and recommended responses to advanced threats.
- It collects and processes behavioral signals from the operating system and send this sensor data to your private, isolated, cloud instance of Microsoft Defender for Endpoint.
- It generate alerts when they are observed in collected sensor data.
- It ensures configuration settings are properly set and exploit mitigation techniques are applied

A

2 It collects and processes behavioral signals from the operating system.

Learning items (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions