CCNA Design security solutions for applications and data Questions

It fully addresses all requirements: it uses OAuth 2.0 with Azure AD for authentication, the 'validate-jwt' policy restricts access to specific Azure AD applications, and the 'rate-limit' and 'ip-filter' policies satisfy the rate limiting and IP filtering requirements. Option A is incorrect because client certificate authentication is not OAuth 2.0. Option B is incorrect because API key authentication is less secure and does not allow restricting to specific Azure AD apps.

Option C is incorrect because while it uses OAuth 2.0 and validate-jwt, it does not include the required rate limiting and IP filtering policies.

The application is a line-of-business app used by employees and external partners, which implies it may be a public client (e.g., mobile or desktop) that cannot securely store a client secret. OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended authentication pattern for such clients because it eliminates the need for a client secret by using a dynamically generated code verifier. This ensures the client secret is never exposed.

Option B is correct. Option A (system-assigned managed identity) is only suitable for Azure-hosted services, not client applications. Option C (storing client secret in Key Vault) still requires secret retrieval at runtime, which can be insecure for public clients.

Option D (implicit grant flow) is outdated and less secure than authorization code flow with PKCE.

OAuth 2.0 with client credentials grant authenticates the client application, while OpenID Connect extends OAuth 2.0 to verify the end-user's identity. Together, they satisfy both requirements: only authorized clients can call the API and the end-user's identity is confirmed. Option A (HTTP Basic Authentication) transmits credentials in plaintext and does not support user identity verification beyond the client.

Option C (JWT bearer tokens) is a token format, not a full authentication protocol; it lacks client authentication and user verification on its own. Option D (API keys) only authenticate the client, not the user, and are typically used for simple access control.

Options C and E are correct. Configuring anomaly detection policies (Option C) helps identify unusual user behaviors that may indicate a security threat. Enabling session monitoring for critical applications (Option E) allows real-time monitoring and control of user activities, which can block risky actions as they occur.

Option A is incorrect because blocking all third-party app access is overly restrictive and not a targeted measure for detecting risky user activities. Option B is incorrect because defining IP address ranges for trusted locations is for location-based policies, not for detecting risky behaviors. Option D is incorrect because app discovery policies are used to discover shadow IT, not to monitor or block risky user activities.

ASE v3 is deployed in a VNet, providing network isolation. Enforcing HTTPS only with TLS 1.2 ensures encryption in transit. Using system-assigned managed identity allows identity-based access to Azure SQL Database.

TLS/SSL certificates from Azure Key Vault support certificate management. Option A is wrong because a multi-tenant App Service plan does not provide network isolation, failing the VNet integration requirement. Option C is wrong because App Service certificates are not managed via Key Vault, failing the certificate management requirement.

Option D is wrong because service principal is less secure than managed identity and does not meet the identity-based access requirement.

It provides the most comprehensive security for HIPAA/HITRUST compliance. Customer-managed keys in Azure Key Vault give Contoso control over encryption keys, which is required by HIPAA. TLS 1.2 ensures encryption in transit.

A private endpoint for Cosmos DB prevents public internet access, offering better isolation than service endpoints or firewall rules. Finally, granting the managed identity access via Azure RBAC with a custom role allows granular, least-privilege access to specific containers, which is more secure than using built-in roles or connection strings. Option A is wrong because service-managed keys do not provide the key control required for HIPAA, and service endpoints are less secure than private endpoints.

Option B is wrong because disabling encryption at rest is a security risk and contrary to compliance requirements; also, storing a read-write key in Key Vault (to be retrieved by the app) is less secure than using managed identity with RBAC. Option C is wrong because firewall rules are less secure than private endpoints, and storing read-write keys in application settings is a security risk.

The 'SQL servers on machines' plan applies to SQL Server instances on Azure VMs (IaaS), not to Azure SQL Database (PaaS). Option B is correct: enabling Azure Defender for SQL at the subscription level automatically enables threat detection for all Azure SQL databases in that subscription. Option C is incorrect: SQL Vulnerability Assessment identifies vulnerabilities but does not enable threat detection.

Option D is correct: enabling Advanced Threat Protection on each SQL server individually also ensures threat detection for all databases on that server, though it is less efficient than subscription-level enablement. Option E is incorrect: SQL auditing is for compliance and auditing, not threat detection.

(Configure private endpoints) ensures that network traffic to the SQL Database and Storage account is isolated to the virtual network, meeting the requirement to restrict network access to only the App Service. Option C (system-assigned managed identity) enables the App Service to authenticate to Azure SQL Database and Storage without storing credentials, aligning with the managed identity and Key Vault requirements. Option A is incorrect because using a connection string with a storage account access key introduces a secret and bypasses managed identity.

Option D is incorrect because SAS tokens are also secrets and less secure than managed identities. Option E is incorrect because service endpoints do not provide the same level of private network isolation as private endpoints and rely on public endpoints with network rules.

It provides comprehensive encryption: TDE with a customer-managed key in Azure Key Vault encrypts data at rest, Always Encrypted protects sensitive columns (e.g., credit card numbers) with column-level encryption, TLS 1.2 secures data in transit, and Azure AD managed identities with a firewall rule restricted to the AKS cluster's outbound IP ensure secure authentication and access control. This combination meets PCI DSS and GDPR requirements.

Option B is incorrect because storing the customer-managed key in the application's configuration file is insecure and violates best practices for key management; keys must be stored in a secure vault like Azure Key Vault.

Option C is incorrect because application-level encryption alone does not guarantee data-at-rest encryption within Azure SQL Database, and disabling firewall rules (using no firewall) exposes the database to unauthorized access.

Option D is incorrect because it uses a service-managed key (less control), TLS 1.0 (not PCI DSS compliant), and SQL authentication (less secure than Azure AD managed identities).

Azure SQL Database audit logs (Option D) capture detailed information about database queries and operations, which can help detect unauthorized data access. Azure Activity Logs (Option E) provide visibility into management-plane events such as changes to database configurations or firewall rules. Network Security Group (NSG) flow logs (Option C) show network traffic patterns to and from Azure SQL Database, enabling the detection of abnormal data transfer volume or patterns indicative of exfiltration.

Options A and B are incorrect: Microsoft Defender for Cloud alerts provide security recommendations and alerts but not raw data exfiltration details; Azure AD sign-in logs focus on user authentication events, not database operations.

Options B and C are correct. Azure App Service authentication can be configured to use Microsoft Entra ID for user authentication, and a Conditional Access policy can enforce MFA and restrict IP ranges. Option A is incorrect because applying an NSG to the App Service subnet is not the direct method for IP restriction; IP restrictions can be configured directly in the App Service settings.

Option D is incorrect because Azure Firewall is a network-level firewall and does not handle user authentication or application-level access control. Option E is incorrect because registering the application is a prerequisite but not a component that directly enforces access rules.

Enforce TLS for Azure SQL Database connections ensures data in transit is encrypted, meeting the encryption requirement. Option D: Azure Web Application Firewall (WAF) on Azure Front Door protects against common web attacks like SQL injection and XSS. Option A is incorrect because Azure Private Link provides private connectivity but does not directly protect against web attacks or encrypt data in transit.

Option C is incorrect because Network Security Groups (NSGs) filter network traffic but do not provide encryption or web application protection. Option E is incorrect because Azure DDoS Protection Standard protects against network-layer attacks, not specifically web application attacks.

The correct answers are B, C, and E. Azure Key Vault is the recommended service for storing secrets securely. Using Azure DevOps variable groups linked to Key Vault allows secrets to be referenced without exposing them in pipeline code.

Managed identities provide a secure way for Azure resources to authenticate to Key Vault without storing credentials. Option A is incorrect because storing secrets in Azure DevOps pipeline variables with encryption is less secure than using Key Vault, as secrets may still be exposed in logs or exportable. Option D is incorrect because storing secrets in a configuration file in a private Git repository is insecure; even if encrypted, the key management is challenging and secrets can be accidentally exposed.

Azure Key Vault provides secure storage for secrets and certificates, and App Service can reference them via managed identity or Key Vault references. Option A is wrong because the Azure AD app registration manifest is for application configuration and should not be used to store secrets; instead, use the 'Certificates & secrets' section. Option B is wrong because App Service application settings are less secure and can be accessed through the portal, lacking the fine-grained access control and auditing of Key Vault.

Option D is wrong because storing the secret in code exposes it to source control and accidental disclosure.

It uses managed identity for secure secret access, integrates Key Vault with AKS using the Secrets Store CSI driver for automatic secret rotation and encryption, deploys the cluster as a private cluster for network isolation, and enables diagnostic settings on Key Vault for audit logging. Option B is wrong because it uses a service principal (less secure than managed identity) and stores secrets as Kubernetes secrets (not encrypted at rest by default). Option C is wrong because it stores secrets in native Kubernetes secrets instead of Key Vault, and uses a private endpoint only for the API server, not full cluster isolation.

Option D is wrong because it uses a service principal and stores secrets as encrypted Kubernetes secrets with a customer-managed key, which is not as secure as Key Vault integration, and uses a public cluster.

It leverages Azure Policy to enforce encryption and network policies at the cluster level, while Azure SQL Database's TDE and Always Encrypted provide encryption at rest and in transit. This combination meets PCI DSS requirements for data encryption and network segmentation in AKS. Option A is wrong because App Service Environment is not used for AKS; the question specifies AKS.

Option B is wrong because Service Endpoints do not encrypt traffic and provide limited segmentation compared to private endpoints. Option C is wrong because Azure Firewall is a network firewall and does not enforce encryption or network policies within the AKS cluster.

Microsoft Purview can scan data sources like Azure Data Lake Storage and Azure SQL Database, classify sensitive data such as PHI, and auto-apply sensitivity labels. Azure SQL Database supports Azure AD authentication and row-level security (RLS) to restrict access to sensitive data based on user identity. Auditing logs can be sent to Log Analytics for compliance.

Option B is incorrect because it requires manual labeling and does not use row-level security. Option C uses Defender for Cloud (not Purview) and Always Encrypted (which does not prevent access to authorized users). Option D uses data masking (obfuscation) rather than access control and lacks auto-labeling and auditing integration.