AZ-900T0x_Module 04: Security

How can Tailwind Traders enforce having only certain applications run on its VMs?

• Connect your VMs to Azure Sentinel.

• Create an application control rule in Azure Security Center.

• Periodically run a script that lists the running processes on each VM. The IT manager can then shut down any applications that shouldn't be running.

Answer explanation

That's correct. With Azure Security Center, you can define a list of allowed applications to ensure that only applications you allow can run. Azure Security Center can also detect and block malware from being installed on your VMs.

What's the easiest way for Tailwind Traders to combine security data from all of its monitoring tools into a single report that it can take action on?

• Collect security data in Azure Sentinel.

• Build a custom tool that collects security data, and displays a report through a web application.

• Look through each security log daily and email a summary to your team.

Answer explanation

That's correct. Azure Sentinel is Microsoft's cloud-based SIEM. A SIEM aggregates security data from many different sources to provide additional capabilities for threat detection and responding to threats.

Which is the best way for Tailwind Traders to safely store its certificates so that they're accessible to cloud VMs?

• Place the certificates on a network share.

• Store them on a VM that's protected by a password.

• Store the certificates in Azure Key Vault.

Answer explanation

That's correct. Azure Key Vault enables you to store your secrets in a single, central location. Key Vault also makes it easier to enroll and renew certificates from public certificate authorities (CAs).

How can Tailwind Traders ensure that certain VM workloads are physically isolated from workloads being run by other Azure customers?

• Configure the network to ensure that VMs on the same physical host are isolated.

• Configure the network to ensure that VMs on the same physical host are isolated.

• Run the VMs on Azure Dedicated Host.

Answer explanation

That's correct. Azure Dedicated Host provides dedicated physical servers to host your Azure VMs for Windows and Linux.

An attacker can bring down your website by sending a large volume of network traffic to your servers. Which Azure service can help Tailwind Traders protect its App Service instance from this kind of attack?

• Azure Firewall

• Network security groups

• Azure DDoS Protection

Answer explanation

DDoS Protection helps protect your Azure resources from DDoS attacks. A DDoS attack attempts to overwhelm and exhaust an application's resources, making the application slow or unresponsive to legitimate users.

What's the best way for Tailwind Traders to limit all outbound traffic from VMs to known hosts?

• Configure Azure DDoS Protection to limit network access to trusted ports and hosts.

• Create application rules in Azure Firewall.

• Ensure that all running applications communicate with only trusted ports and hosts.

Answer explanation

Azure Firewall enables you to limit outbound HTTP/S traffic to a specified list of fully qualified domain names (FQDNs).

How can Tailwind Traders most easily implement a deny by default policy so that VMs can't connect to each other?

• Allocate each VM on its own virtual network.

• Create a network security group rule that prevents access from another VM on the same network.

• Configure Azure DDoS Protection to limit network access within the virtual network.

Answer explanation

A network security group rule enables you to filter traffic to and from resources by source and destination IP address, port, and protocol.