CloudAcademy Practice Exam Flashcards
When configuring Azure Firewall network rules to allow connections to an application’s DNS server, which port number(s) should you select?
A. 53
B. 22
C. 25
D. 67 and 68
A. 53
Explanation:
SSH - 22
SSH is also referred to as 'Secure Shell'. It operates on the port number 22 of the TCP protocol. It carries out the task of remotely connecting to a remote server or host. It allows you to execute a number of commands and move your files remotely as well. However, it is one of the most secure ways of accessing your files remotely. Using this port, you can remotely connect to a computer and move your files with ease. This port sends the data over the network in an encrypted form which adds an extra layer of security on it. In addition to this, only authorized people will be able to remotely log on to their systems using the Port 22 which makes sure that the information does not get into unauthorized hands. It provides the chance to move files within networks as well as gives the privilege to move files between different networks securely. It operates at the Application Layer of the TCP/IP Model and is considered as one of the most secure and reliable ports for accessing files remotely.
DNS - 53
DNS is referred to as 'Domain Name System'. It operates on the port 53 of TCP and UDP protocols. DNS makes use of relational databases to link the host names of the computers or networks to their respective IP Addresses. The port 53 waits for requests from DHCP to transfer the data over the network. It operates on the Application Layer of the TCP/IP Model.
DHCP - 67, 68
DHCP is also known as ‘Dynamic Host Configuration Protocol’. It basically runs on the UDP protocol. The basic purpose of DHCP is to assign IP Address related information to the clients on a network automatically. This information may comprise of subnet mask, IP Address etc. Many of the devices are automatically configured to look for IP Addresses using DHCP when they connect on a network. It makes it quite reliable to assign all the devices on a network with automatically produced IP Addresses. It generally operates on the Application layer of the TCP/IP Model. DHCP basically makes use of 2 ports; Port 67 and Port 68.
You need to investigate unexpected errors caused by requests initiated by web applications hosted on Azure. You suspect errors were caused by several types of resources, including compute, storage, notifications, and key management.
The best course of action is to compile all the data and then create queries to analyze the data manually.
What type of log data should you review first, and what service should you use to review the data?
A. Review diagnostic logs with Log Analytics
B. Review activity logs with Azure Event Hub
C. Review application logs with Azure Queue Storage
D. Review boot diagnostic logs with Azure Table Storage
A. Review diagnostic logs with Log Analytics
Explanation:
To determine the right type of data to analyze, the key factor is that the errors were likely within requests from Azure services, which are actions tracked by diagnostic logs. It would also not be application logs, in this case, because the errors involve multiple types of resources, not just compute resources.
To determine the best service, the ability to create queries of log data is offered specifically by Log Analytics.
Bookmark
Learn more: https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-overview-of-diagnostic-logs?toc=/azure/azure-monitor/toc.json
Microsoft Defender for Cloud security policies can do all except which of the following?
A. Data collection from deployed resources
B. Security recommendations based on general best practices
C. Provide instructions on how to address existing security vulnerabilities
D. Enforce compliance with general security best practices
D. Enforce compliance with general security best practices
Explanation:
Microsoft Defender for Cloud is focused on monitoring your environment and alerting you to potential security threats. On its own, it does not enforce compliance - this is possible through Azure Policy.
A company is building an application which is going to be hosted in Azure. They want the application to allow users to sign up by using their existing social accounts. Which of the following methods can help fulfill this requirement?
A. Set up a separate tenant. Use SAML to allow users to sign-up.
B. Set up a separate tenant. Use ws-federation to allow users to sign-up.
C. Create a separate Azure B2C directory. Register the application with the Azure Active Directory B2C directory.
D. Create a separate Azure directory. Register the application with the Azure Active Directory directory.
C. Create a separate Azure B2C directory. Register the application with the Azure Active Directory B2C directory.
Explanation:
Azure B2C is a separate directory that can make it easier for consumers that have social accounts to sign up for applications hosted in Azure. When they use Azure Active Directory B2C, the consumers can sign up for your applications by using their existing social media accounts (Facebook, Google, Amazon, LinkedIn) or by creating new credentials.
You are the owner of a resource group that contains the following Azure resources:
VNet1, which contains Subnet1. Subnet1 is assigned a routing table, and a network security group named NSG-1. SubNet1 contains an ARM virtual machine 1 with a private IP address only.
VM-Database1 needs to connect to an on-premises static IP address (216.3.128.12) to request software updates. You do not want to reveal the IP address of the ARM virtual machine 1. All inbound traffic aside from the software updates should be blocked.
Which steps should you take to allow the database to connect successfully for updates while limiting threats? (Choose 2 answers.)
A. Deploy a private load balancer associated with the ARM virtual machine.
B. Deploy a NAT gateway associated with Subnet1.
C. Update NSG-1 to allow outbound traffic to and from 216.3.128.12 over port 443. Include no other rules allowing traffic.
D. Update NSG-1 to allow outbound traffic to 216.3.128.12 over port 443. Include no other rules allowing traffic.
B. Deploy a NAT gateway associated with Subnet1.
D. Update NSG-1 to allow outbound traffic to 216.3.128.12 over port 443. Include no other rules allowing traffic.
Explanation:
Network security group security rules are evaluated by priority using the 5-tuple information (source, source port, destination, destination port, and protocol) to allow or deny the traffic. A flow record is created for existing connections. Communication is allowed or denied based on the connection state of the flow record. The flow record allows a network security group to be stateful.
Deploy a Network Address Translation or NAT gateway to enable Source Network Address Translation (SNAT). As Microsoft explains in its documentation:
Source Network Address Translation (SNAT) rewrites the source of a flow to originate from a different IP address and/or port. Typically, SNAT is used when a private network needs to connect to a public host over the internet. SNAT allows multiple compute resources within the private VNet to use the same single Public IP address or set of IP addresses (prefix) to connect to the internet.
What term describes a private, encrypted connection between an on-premises location and Azure, in which traffic technically passes over the internet?
A. A DNS zone
B. A Site-to-Site VPN connection
C. A Point-to-Site VPN connection
D. A VNet Peering connection
B. A Site-to-Site VPN connection
Explanation:
You want to be familiar with what is available in Azure in terms of connecting different network sites, whether it be on-premises Azure or Azure-to-Azure and their limitations. For example, a site to site connection is your typical on-premises to Azure connection and although traffic technically passes over the internet, this is a private connection, traffic is encrypted and secured through IPSec tunnels. A point-to-site connection is for connecting individual client computers to an Azure Virtual Network. A VNet Peering connection is an Azure-to-Azure connection which does not have to use VPN Gateways for connectivity across Azure VNets.
Bookmark
Learn more: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal
You are configuring data security settings for separate Azure SQL databases. Database A stores social security numbers, which you want to prevent any users or applications from viewing. The social security numbers appear in one column within a single table of Database A.
Database B stores credit card information, including credit card numbers, which only privileged database administrators should be able to see. The credit card numbers appear in columns within several tables in Database B.
How should you configure the data encryption settings for these databases to meet these requirements?
A. Enable ‘Always Encrypted’ for Database A, and Dynamic Data Masking (DDM) for Database B.
B. Enable ‘Always Encrypted’ for Database A and Database B.
C. Enable Dynamic Data Masking (DDM) for Database A, and ‘Always Encrypted’ for Database B.
D. Enable Dynamic Data Masking (DDM) for Database A and Database B.
A. Enable ‘Always Encrypted’ for Database A, and Dynamic Data Masking (DDM) for Database B.
Explanation:
Always Encrypted’ prevents any users or applications from viewing or decrypting data, so in cases where data should be stored but never accessed by anyone accept the customer, this feature should be enabled.
Dynamic Data Masking allows only privileged users to view specific data.
How often data appears within a database would not affect the encryption feature you enable, only how you apply it, which is not a factor in answering this question
How does Microsoft Defender for Cloud ensure compliance with company and regulatory security requirements?
A. Customization by administrators
B. Pre-defined policies in the Azure subscription
C. Centralized Policy Management
D. By making recommendations to remediate security vulnerabilities
C. Centralized Policy Management
Explanation:
Through centralized policy management, compliance with company and regulatory security requirements is ensured.
Azure Policy focuses on enforcing organizational standards on Azure ______________.
A. resources
B. users
C. groups
D. costs
A. resources
Explanation:
With policies, you can prevent users in your organization from breaking conventions that are needed to manage your organization’s resources. It is important to note that policies and RBAC work together. However, there are differences. RBAC focuses on the actions a user can perform at different scopes while policy focuses on resource actions at various scopes.
You have a microservice application hosted on Azure App Services named Azure Service Environment 1. The application communicates with on-premise database servers and data analysis applications. You need to find an effective monitoring solution to do the following:
Monitor performance of Azure Service Environment 1 and the on-premise database servers. Provide alerts when communication between the on-premise database and Azure Service Environment 1 is disrupted. Provide quantitative data regarding customer usage.
What Azure services or features within Azure App Service can meet all your requirements?
A. Azure Application Insights
B. Azure Monitor
C. Azure App Service Diagnostic Logs
D. Azure App Service Metrics
A. Azure Application Insights
Explanation:
Application Insights can collect data from applications in Azure, running on-premise, or on other clouds. The integration with Azure Web Apps makes it exceptionally easy to use in Azure.
Which of the following statements regarding multi-factor authentication and Azure Privileged Identity Management, or PIM, is correct?
A. All PIM users are required to complete multi-factor authentication when logging in.
B. Multi-factor authentication for PIM users requires Azure MFA.
C. Existing on-premise Active Directory ID providers can manage MFA for PIM logins.
D. Existing third-party ID providers can perform MFA for PIM logins.
C. Existing on-premise Active Directory ID providers can manage MFA for PIM logins.
Explanation:
There are two options for validating MFA when a user activates a role.
The simplest option is to rely on Azure MFA for users who are activating a privileged role. To do this, first check that those users are licensed, if necessary, and have registered for Azure MFA. For more information about how to deploy Azure MFA, see Deploy cloud-based Azure Multi-Factor Authentication. It is recommended, but not required, that you configure Azure AD to enforce MFA for these users when they sign in. This is because the MFA checks will be made by PIM itself.
Alternatively, if users authenticate on-premises, you can have your identity provider be responsible for MFA. For example, if you have configured AD Federation Services to require smartcard-based authentication before accessing Azure AD, Securing cloud resources with Azure Multi-Factor Authentication and AD FS includes instructions for configuring AD FS to send claims to Azure AD. When a user tries to activate a role, PIM will accept that MFA has already been validated for the user once it receives the appropriate claims.
You delete an existing B2C tenant, and re-create it with the same domain name. Now users are not able to sign-in. What does Microsoft recommend in this situation?
A. Create the B2C tenant with a different domain name.
B. Create the B2C tenant with an identical domain name.
C. Call support
D. Create the B2C tenant with a similar domain name and add a number to it which you will delete in the future.
A. Create the B2C tenant with a different domain name.
Explanation:
There are known issues when deleting an existing B2C tenant and recreating it with the same domain name. In order to resolve this issue create a B2C tenant with a different domain name.
A company hosts a web-based .Net application in Azure. They require that whenever an abnormal activity occurs, such as high page request rate, a custom application is notified so that it can be handled accordingly. Which option below meets this requirement?
A. Create an alert in the Azure dashboard and configure the email alert. Ensure the custom application consumes the email alerts.
B. Create a custom powershell utility to check the the application request rate and then alerts the custom application accordingly.
C. Create an alert and use the Webhook functionality to send the notification to the custom application.
D. Create a custom utility that monitors and checks the application request rate and then sends the alert to the custom application.
C. Create an alert and use the Webhook functionality to send the notification to the custom application.
Explanation:
Webhooks allow one to route an Azure alert notification to other systems for post-processing or custom actions. A lot of custom systems support webhooks, hence this is the ideal implementation to alert third party systems to any irregularities generated by alerts in Azure.
Through a series of corporate acquisitions, your company recently acquired two new branch offices. You would like to sync your identity and access management systems using Azure Active Directory to allow shared access to training applications and other corporate resources. Key details are listed below.
Your office (Office 1) has an on-premise employee training application with single sign-on managed through Active Directory Federation Services. Office 1 and Office 2 are different branch offices that share access to company resources within the same single Azure AD tenant. Office 3 is a recently acquired office with separate resources secured by a proprietary identity and access management solution. Technically Office 3 is a different company owned by the same parent company that owns Offices 1 and 2.
Office 1 has enabled the necessary Azure Active Directory single sign-on solution to allow access to the on-premise training application through Azure and Office 365. Office 2 can now connect and access the training application, but Office 3 cannot.
Which Azure AD feature can allow Office 3 employees to access the training resources with their existing IAM credentials?
A. Azure AD B2B
B. Azure AD B2C
C. Azure Hybrid Identities
D. Azure AD Connect
A. Azure AD B2B
Explanation:
Azure Active Directory Business-to-Business collaboration, also known as Azure AD B2B, allows an organization to securely share company applications and company services with guest users from other organizations while retaining control over company data. With Azure AD B2B, an organization can work with external partners, even if they don’t use Azure AD. The invitation and redemption process of Azure AD B2B allows users in a partner organization to use their own credentials to access a company’s resources. Because the partner organization uses its own identity management solution, the external administrative overhead for the sharing organization is essentially non-existent. There’s no requirement to manage external accounts or passwords, nor is there a need to synchronize accounts or manage account lifecycles.
As your company’s database administrator and owner of a Cosmos DB account, you need to create a new Cosmos DB database to support an application currently being developed. You also need to grant access to a member of your IT staff who will be testing the new application. The developer will need to create containers and modify the Cosmos DB database settings to fine-tune them.
Additionally, you will need to create the necessary credentials for the application, which will be hosted on Azure App Service web apps, to connect with the database, and will upload, modify and read data to fulfill expected requests.
To simplify the testing process, you would like to create a set of application credentials that persists while the test resources themselves may be continuously created and deleted throughout the development process. You also want to provide access to the IT staff member following general security best practices.
How should you proceed?
A. Create the database using the primary or secondary read-write master key. Assign the IT staff member Account Contributor role through Azure Active Directory. Create a user-assigned managed identity for the application hosted on Azure App Service web apps.
B. Create the database using the primary read-write master key. Provide access to the IT staff member using the secondary read-write master key. Create a user-assigned managed identity for the application hosted on Azure App Service web apps.
C. Create the database using the primary or secondary read-write master key. Assign the IT staff member Account Contributor role through Azure Active Directory. Create a system-assigned managed identity for the application hosted on Azure App Service web apps.
D. Create the database using the primary or secondary read-write master key. Provide access to the IT staff member using the primary read-only master key. Create a system-assigned managed identity for the application hosted on Azure App Service web apps.
A. Create the database using the primary or secondary read-write master key. Assign the IT staff member Account Contributor role through Azure Active Directory. Create a user-assigned managed identity for the application hosted on Azure App Service web apps.
Explanation:
The master keys are essentially the root access keys for the Cosmos DB account owner, and can be used to create resources, but should not be shared. Assigning permissions via RBAC is the best course of action in this case, and creating a user-assigned managed identity means the credentials will persist and can be repeatedly assigned to new and different resources in the dev/test environment.
Your organization is implementing an application that will be published through the Azure Active Directory (Azure AD) application proxy primarily enabling access to on-premises applications. The application relies on a central on-premises directory like Windows Server Active Directory. What statement describes how identity and access management occur?
A. Access to this application is enabled through an X.509 certificate and SSH key.
B. Access to this application is enabled through directory information and token issuance.
C. The access credential may be a federation token or user-name and password for an account that was previously provisioned in the application.
D. Access to this applications is enabled by triggering the proxy to deliver the application content to the end user while honoring the on-premises sign-on requirement.
D. Access to this applications is enabled by triggering the proxy to deliver the application content to the end user while honoring the on-premises sign-on requirement.
Explanation:
It important to understand that the way the authorization is enacted on the target application varies depending on how the application was integrated with Azure AD. There are on-premises applications. These applications are published through the Azure AD application proxy primarily enabling access to on-premises applications. These applications rely on a central on-premises directory like Windows Server Active Directory. Access to these applications is enabled by triggering the proxy to deliver the application content to the end user while honoring the on-premises sign-on requirement.
