Azure Fundamentals Module 4 Review

How can companies enforce having only certain applications run on its VMs?

• Connect your VMs to Azure Sentinel

• Create an application control rule in Azure Security Center

• Periodically run a script that lists the running processes on each VM. The IT manager can then shut down any applications that shouldn't be running.

What's the easiest way for companies to combine security data from all of its monitoring tools into a single report that it can take action on?

• Collection security data in Azure Sentinel.

• Build a custom tool that collects security data and displays a report through a web application.

• Look through each security log daily and email a summary to your team.

Which is the best way for companies to safely store its certificates so that they're accessible to cloud VMs?

• Place the certificates on a network share.

• Store them on a VM that's protected by a password.

• Store the certificates in Azure Key Vault.

How can companies ensure that certain VM workloads are physically isolated from workloads being run by other Azure customers?

• Configure the network to ensure that VMs on the same physical host are isolated.

• This is not possible. These workloads need to be run on-premises.

• Run the VMs on Azure Dedicated Host.

An attacker can bring down your website by sending a large volume of network traffic to your servers. Which Azure service can help companies protect its App Service instance from this kind of attack?

• Azure Firewall

• Network security groups

• Azure DDoS Protection

What's the best way for companies to limit all outbound traffic from VMs to known hosts?

• Configure Azure DDoS Protection to limit network access to trusted ports and hosts.

• Create application rules in Azure Firewall

• Ensure that all running applications communicate with only trusted ports and hosts.

How can companies most easily implement a deny by default policy so that VMs can't connect to each other?

• Allocate each VM on its own virtual network.

• Create a network security group rule that prevents access from another VM on the same network.

• Configure Azure DDoS Protection to limit network access within the virtual network.