Chapter 4 Rev

You are setting up resources in Azure and need to filter traffic based on source IP address and port, destination IP address and port, and protocol between your on-premises network and Azure. Which of the following meets these minimum requirements?

• ExpressRoute

• Azure Firewall

• Application security groups

• User-defined routes

Is the underlined portion of the following statement true, or does it need to be replaced with

one of the other fragments that appear below?

You are evaluating moving a web application that you host on-premises to Azure. The solution

comprises three VMs—a web front end, an application server, and a database server. You

need to ensure that your administrators can access all of the VMs for remote management on

port 3389, but only the web front end should be accessible over port 80. You decide to deploy

an application security group to protect the web server and enable access to the other servers.

• deploy Web Application Firewall to filter and route traffic to the web server and deploy

  network security groups to enable RDP to all three VMs.

• deploy Web Application Firewall to filter the traffic and meet both requirements.

• deploy a network security group to filter traffic and meet both requirements.

• No change is needed.

You have deployed a VM to a subnet in Azure and need to ensure that only your and one other individual can connect to the VM using RDP on port 3389 to manage it. No other access from outside the subnet should be allowed at this time on any other ports. Which of the following should you use?

(Choose all that apply.)

• Use a network security group to filter traffic and only allow port 3389 to the VM.

• Apply an Azure policy to the subnet to limit access on port 3389 to only your and your

  peer’s accounts.

• Create a policy initiative that restricts access to the server based on your and your peer’s

  roles, and to port 3389 for the IP address of the VM.

• Use role-based access control (RBAC) to ensure that only you and your peer can access

  the server.

You are considering deploying a key web application to Azure. You decide to deploy Web Application Firewall with Application Gateway as part of the project. Which of the following correctly describes the function of Web Application Firewall in this scenario?

• When properly configured, it ensures that traffic reaches the application only on port 80

  for HTTP traffic.

• It protects the web application from common web-based attacks.

• It ensures that users can reach the web service on port 80 and administrators can RDP

  to the VMs on port 3389.

• None of the above.

Your organization hosts a VM that performs a security-related function. For both security and auditing purposes, you need to ensure that all traffic reaches the VM from a single IP address in another subnet, regardless of source. Which of the following solutions meets this requirement?

• Create a network security group (NSG) that directs all traffic for the VM to the

  designated IP address and then apply the NSG to all subnets as required.

• Create an application security group (ASG) that directs all traffic for the VM to the

  designated IP address and apply the ASG to all subnets in the virtual network.

• Create a user-defined route as a custom routing table and apply the table to all subnets

  in the virtual network.

• Use rules in Azure Firewall to route traffic to the target VM based on source and target

  IP addresses.

Which of the following describes Azure DDoS Protection Standard?

Choose all that apply.

• It protects against volumetric, protocol, and resource layer attacks.

• It alerts you when an attack is happening.

• DDoS Standard protects all resources on a virtual network as soon as the service is

  enabled.

• It provides mitigation reports.

Your organization has made the decision to move workloads into Azure. As the Directory Services administrator, you need to explain authentication and authorization in Azure to the program managers leading the project. Which of the following are correct statements?

• Identifying a user by a username and password is a form of authorization.

• Validating that a user account has the necessary permissions to access a resource is an

  example of authorization.

• Authentication identifies a user but does not provide access to resources.

• Providing a password to access a shared resource is a form of authorization.

Which of the following is the least expensive option that enables Azure AD users to change their passwords online?

• Azure Active Directory Base

• Azure Active Directory Free

• Azure Active Directory Premium P1

• Azure Active Directory Premium P3

Which of the following correctly describe Azure Active Directory?

(Choose all that apply.)

• Azure AD is a key component of role-based access control (RBAC) in Azure.

• You must register an Azure web application with Azure AD to enable that application to

  authenticate and authorize users.

• All editions of Azure AD enable management of users and groups.

• You must use on-premises Active Directory along with Azure AD to enable on-premises

  users to authenticate in Azure.

Which of the following capabilities require an Azure AD Premium edition? (Choose all that apply.)

• Self-service password management for on-premises users, enabling them to change their

  own passwords

• Enabling users to access on-premises resources such as an on-premises website using an

  Azure AD account

• Managing Azure AD groups

• Using RBAC to control access to resources with policies and initiatives