General Security and Network Security

Question 1

Azure Security Center

Answer 1

A monitoring service that provides threat protection/security recommendations across both Azure and on-prem DCs

• Detect and block malware
• Analyze and identify potential attacks
• Just-in-time access control for ports

Question 2

Azure Security Center Capabilities

Answer 2

• Policy compliance - run policies across management groups, subs, or tenants
• Continuous assessments - assess new/deployed resources to ensure proper configuration
• Tailored recommendations - based on existing workloads w/ instructions on how to implement
• Threat protection - analyze attempted threats thru alerts/impacted resource reports

Question 3

Azure Sentinel

Answer 3

A security information management (SIEM) and security automated response (SOAR) solution that provides security analytics and threat intelligence across an enterprise.

Question 4

Azure Sentinel Connectors and Ingrations

Answer 4

• Office 365
• Azure Active Director
• Azure Advanced Threat Protection
• Microsoft Cloud App Security

Question 5

Azure Key Vault

Answer 5

Stores application secrets in a centralized cloud location in order to securely control access permissions and access logging

Question 6

Azure Key Vault Storage

Answer 6

• Secrets management.
• Key management.
• Certificate management.
• Storing secrets backed by hardware security modules (HSMs).

Question 7

Azure Key Vault Integration

Answer 7

• Simplified administration of application secrets.
• Key Vault makes it easier to enroll and renew certificates from public certificate authorities
• Can also scale up/replicate content within regions and use standard certificate management tools.
• Can integrate Key Vault with storage accounts, container registries, event hubs, and many more Azure services,
which can then securely reference the secrets stored in Key Vault.

Question 8

Azure Dedicated Host

Answer 8

Provides physical servers that host one or more Azure virtual machines that is dedicated to a single organization’s workload.

Benefits
• Hardware isolation at the server level
• Control over maintenance event timing
• Aligned with Azure Hybrid Use Benefits

Question 9

Defense in Depth

Answer 9

• A layered approach to securing computer systems.
• Provides multiple levels of protection.
• Attacks against one layer are isolated from subsequent layers.

Question 10

Physical security layer

Answer 10

The first line of defense to protect computing hardware in the datacenter

Question 11

Identity and access layer

Answer 11

Controls access to infrastructure and change control. The identity and access layer is all about ensuring that identities are secure, access is granted only to what’s needed, and sign-in events and changes are logged.

Question 12

Perimeter layer

Answer 12

• Uses DDoS protection to filter large-scale attacks before they can cause a denial of service for users.
• At the network perimeter, it’s about protecting from network-based attacks against your resources.
• Identifying attacks, eliminating impact, and alerting are important ways to keep your network secure.

Question 13

Network layer

Answer 13

• Limits communication between resources through segmentation and access controls.
• At this layer, focus is on limiting the network connectivity across all your resources to allow only what’s required.
• By limiting this communication, you reduce the risk of an attack spreading to other systems in your network.

Question 14

Compute layer

Answer 14

• Secures access to virtual machines.
• Malware, unpatched systems, and improperly secured systems open your environment to attacks.
• Focus is on ensuring your compute resources are secure and the proper controls are in place

Question 15

Application layer

Answer 15

• Helps ensure applications are secure and free of security vulnerabilities.
• Helps reduce the number of vulnerabilities introduced in code.
• Every development team should ensure that its applications are secure by default.

Question 16

Data layer

Answer 16

• Controls access to business and customer data that you need to protect.
• Those who store and control access to data are responsible for ensuring that it’s properly secured.
• Reg requirements dictate the controls and processes required to ensure CIA of the data.

Question 17

Shared Security

Answer 17

• Migrating from customer controlled to cloud-based datacenters shifts the responsibility for security.
• Security becomes a shared concern between cloud providers and customers.

Question 18

Network Security Groups

Answer 18

• Filter network traffic to and from Azure resources on Azure Virtual Networks.
• Set inbound and outbound rules to filter by source and destination IP address, port, and protocol.
• Add multiple rules, as needed, within subscription limits.
• Azure applies default, baseline security rules to new NSGs.
• Override default rules with new, higher priority rules.

Question 19

Azure Firewall

Answer 19

• A stateful, managed Firewall as a Service (FaaS) that grants/denies server access based on originating IP address
to protect network resources.
• Applies inbound and outbound traffic filtering rules
• Built-in high availability
• Unrestricted cloud scalability
• Uses Azure Monitor logging

Question 20

Azure Application Gateway

Answer 20

Provides a firewall, web app firewall, which provides centralized, inbound protection for web apps

Question 21

Stateful Firewall

Answer 21

Analyzes the complete context of a network connection, not just an individual packet of network traffic. Azure Firewall features high availability and unrestricted cloud scalability.

Question 22

Azure Firewall Benefits

Answer 22

• Azure Firewall provides a central location to create, enforce, and log application and network connectivity policies
across subscriptions and virtual networks.
• Uses a static (unchanging) public IP address for your virtual network resources, which enables outside firewalls to
identify traffic coming from your virtual network.
• The service is integrated with Azure Monitor to enable logging and analytics.

Question 23

Azure DDoS Protection

Answer 23

• Sanitizes unwanted network traffic before it impacts service availability.
• Basic service tier is automatically enabled in Azure.
• Standard service tier adds mitigation capabilities that are tuned to protect Azure Virtual Network resources.

Question 24

Defense in Depth Order

Answer 24

Physical Security
Identity & Access
Perimeter
Network
Compute
Application
Data

Question 25

Defense in Depth Reviewed

Answer 25

• NSGs with Azure Firewall to achieve defense in depth.
• Perimeter layer protects your network boundaries with Azure DDoS Protection and Azure Firewall.
• Networking layer only permits traffic to pass between networked resources with Network Security Group (NSG)
inbound and outbound rules.