Azure Quiz-2a

Is the underlined portion of the following statement true, or does it need to be replaced with one of the other fragments that appear below? Azure Information Protection (AIP) enables organizations to protect emails and documents using encryption, identity, and authorization policies.

• encrypts data stored in Azure Premium storage.

• provides secure storage for certificates, cryptographic keys, and other secrets.

• is a mechanism in Azure Active Directory for encrypting and securing administrator credentials.

• No change is needed.

Answer explanation

Azure Information Protection provides a means to classify documents and emails using

labels, and to optionally protect those items with encryption, identity, and authorization,

making option A correct. AIP does not provide secure storage for secrets; Key Vault serves

that function. AIP is not a mechanism in Azure AD.

Which of the following Azure services can identify suspicious activities such as pass-the-hash attacks?

• Security Center

• Azure Information Protection (AIP)

• Azure Advanced Threat Protection (ATP)

• Microsoft Defender

Answer explanation

Azure Threat Protection (ATP) can detect and identify a variety of threats and provides

reporting and other resources to help secure your environment, making option C the correct

answer. Security Center, AIP, and Microsoft Defender do not provide that threat detection

and reporting capability.

Which of the following threats can ATP help you detect?

• Reconnaissance attacks

• Pass-the-hash

• Pass-the-token

• All of the above

Answer explanation

ATP can help you detect all these types of attacks, as well as brute-force attacks, overpassthe-

hash, and domain dominance attacks.

Which of the following is an example of a honeytoken attack?

• Testing multiple passwords against a username

• Authentication attempts against an alphabetical list of usernames

• Login to a fake account that you created

• None of the above

Answer explanation

Testing multiple passwords against a username is an example of a brute-force attack.

Making authentication attempts against an alphabetical list of usernames is an example of a

reconnaissance attack.

You want to ensure that the VMs created in a resource group do not exceed certain limits for cores and other resources to reduce costs. Which of the following Azure features enables you to control this?

• Resource locks

• Azure policies

• Azure Resource Manager

• Azure initiatives

Answer explanation

Azure policies enable you to create JSON-based rules that apply effects to resources,

such as limiting the types of VMs that can be created in a resource group. Resource locks

apply restrictions on actions that you can take with resources but do not control the types of

resources you can create. Azure Resource Manager is the template-based service that enables you to create resources but does not apply restrictions on resources. Azure initiatives enable

you to create and manage a group of policies but do not apply restrictions themselves.

Is the underlined portion of the following statement true, or does it need to be replaced with one of the other fragments that appear below? Azure initiatives enable you to build blueprints to define how resources should be created and deployed in your Azure environment.

• control how blueprints are published and assigned to resources.

• enable you to manage and implement policies as a group to achieve governance goals.

• define security policies that you apply using Azure Security Center.

• No change is needed.

Answer explanation

An initiative is a group of policies, enabling you to create, manage, and deploy policies

as a group to support governance goals and organizational standards. Blueprints represent a

different service called Azure Blueprints that enable you to create repeatable groups of Azure

resources, role assignments, and policies. You do not assign security policies using Azure

Security Center.

Which of the following are correct statements describing Azure policies? (Choose all that apply.)

• You can apply policies individually to a resource or within an Azure initiative.

• You can apply permissions using policies to determine what actions a user can take against a resource.

• Applying a policy to resource group causes the policy to apply to all resources within that resource group.

• Azure policies are a component of Security Center that enables you to define security-related policies to protect resources.

Answer explanation

You can apply policies individually or within an initiative, which is a group of policies.

You cannot apply permissions using permissions with a policy; instead, you specify what

actions are allowed with a specified scope based on the RBAC permissions a user already

has. A policy applies to all resources within the scope at which it is applied, making option C

correct. Azure policies are not a component of Security Center.

23. C. RBAC is the mechanism that enables you to specify permissions for Azure. Azure policies,

resource groups, and Security Center do not provide any capability to create or assign

permissions.

Which of the following enable you to assign permissions to enable users to create and/or use resources in Azure?

• Azure policies

• Resource groups

• Role-based access control (RBAC)

• Security Center

Answer explanation

RBAC is the mechanism that enables you to specify permissions for Azure. Azure policies,

resource groups, and Security Center do not provide any capability to create or assign

permissions.

You need to delegate the capability to add users in Azure to another individual at your organization. Which of the following RBAC roles should you apply to the user to provide this capability to manage management groups with the least privilege?

• Owner

• User Access Administrator

• Contributor

• Account Administrator

Answer explanation

Although the Owner role has the capability to manage management groups, using the

User Access Administrator role grants the least privileges. The Account Administrator role is

intended for managing subscriptions and billing.

What is the role you should use to grant users the capability to create and manage resources in Azure while ensuring they have the fewest permissions needed?

• Creator

• Reader

• Owner

• Contributor

Answer explanation

There is no Creator role in RBAC. Reader enables a user to access resources but not create

or modify them. The Owner role enables creating and managing resources but does not fit

the requirement for least privilege. Contributor enables the required permission while maintaining

least privilege.