CCNA Design security solutions for infrastructure Questions

Option D is correct because: (1) Enforce TLS 1.2 ensures encryption in transit. (2) Firewall rules restrict access by IP. (3) Dynamic Data Masking hides sensitive data from admins. (4) Auditing logs data access. Option A is wrong because Always Encrypted encrypts data at rest and in use but does not restrict network access. Option B is wrong because VNet service endpoints provide network isolation but do not enforce TLS.

Option C is wrong because Azure AD authentication does not restrict network access or mask data.

Azure AD Conditional Access enforces access policies. Microsoft Defender for Cloud Apps provides cloud access security broker (CASB) functionality. Azure Policy ensures compliance.

Azure Bastion is for secure connectivity. Microsoft Sentinel is for SIEM, not a core zero-trust component.

Option B is correct because Microsoft Entra ID integration provides robust authentication and authorization for the AKS API server. Option A is wrong because local accounts (service principal or client certificate) are less secure and do not integrate with identity management. Option C is wrong because Azure RBAC for Kubernetes is authorization, not authentication.

Option D is wrong because managed identities are for pod authentication, not for users.

Azure Disk Encryption requires the key vault to have EnabledForDiskEncryption set to true. Option A is correct. Option B is incorrect because the parameter is for deployment.

Option C is incorrect because the parameter is for template deployment. Option D is incorrect because the cmdlet sets the property for an existing vault.

Azure SQL Database supports Transparent Data Encryption (TDE) with CMK in Azure Key Vault. Always Encrypted is for column-level encryption. Dynamic Data Masking is for masking, not encryption.

Azure Information Protection is for classification.

Option A is correct because Azure AD integration enables authentication for AKS clusters. Option C is correct because Azure Policy with Gatekeeper can enforce security policies on AKS. Option B is wrong because Network Security Groups apply to VMs, not AKS pods.

Option D is wrong because Azure Firewall is for network-level filtering, not workload security. Option E is wrong because Azure Front Door is for global load balancing, not AKS workload security.

Azure DDoS Protection Standard provides defense against volumetric DDoS attacks. Azure Firewall can filter traffic at the network layer, but its DDoS capabilities are limited; Azure DDoS Protection is the primary service. WAF is for application layer.

NSGs can filter traffic but not mitigate DDoS. Traffic Manager is for load balancing.

Microsoft Entra Connect syncs identities and can be configured to allow NTLM authentication for hybrid identities. PTA or ADFS are for authentication, but not specifically for NTLM support. PHS alone doesn't handle NTLM.

Cloud Kerberos trust is for Kerberos, not NTLM.

Azure Logic Apps is the recommended platform for Sentinel playbooks. Managed identity is the preferred authentication method because it avoids credential management and supports automation. Azure Automation is for runbooks, not playbooks.

Service principal is possible but not recommended due to credential management.

Option C is correct because the policy denies security rules that allow ports other than 22 (SSH) and 3389 (RDP) as destination ports. Option A is wrong because it allows only specific ports. Option B is wrong because it allows those ports.

Option D is wrong because it doesn't enforce a specific range.

Option B is correct because Azure Key Vault securely stores secrets and Azure DevOps can retrieve them without exposing secrets in logs. Option A is wrong because Azure App Configuration is for application configuration, not secrets. Option C is wrong because variable groups can store secrets but they are not as secure as Key Vault.

Option D is wrong because Azure Policy is for governance, not secret management.

Conditional Access in Microsoft Entra ID can require device compliance before granting access to Exchange Online. Device compliance policies in Intune define the security requirements. Azure AD Application Proxy is for on-prem apps.

Microsoft Defender for Cloud Apps is for cloud app security. Windows Defender Firewall is for network security.

Option D is correct because Microsoft Entra Connect with Seamless SSO enables Kerberos-based authentication for hybrid users. Option A is wrong because federation with ADFS is not required for Kerberos. Option B is wrong because PHS does not support Kerberos delegation.

Option C is wrong because PTA does not support Kerberos.

Enabling Defender for Cloud on all subscriptions ensures coverage. Configuring automatic provisioning of the Log Analytics agent ensures data collection. To auto-remediate, you need to use Azure Policy with 'deployIfNotExists' or 'modify' effects, not just enable Defender.

The 'Auto Remediate' setting in Defender for Cloud applies only to certain recommendations, but for custom remediation, Azure Policy is needed. The security contacts are for notifications, not remediation.

Option C is correct because when referencing a Key Vault secret in an ARM template parameter, the user or service principal deploying the template must have 'Get' and 'List' permissions on the secret. If the deployment principal does not have those permissions, access is denied. Option A is wrong because secrets can be used as strings.

Option B is wrong because the resource group is specified, and if the KV is in a different resource group, it's fine as long as permissions are granted. Option D is wrong because the template uses a parameter reference, not a direct secret value.

Option C is correct because implementing a remediation task via Azure Policy can automatically remediate non-compliant resources. Defender for Cloud integrates with Azure Policy to allow automatic remediation. Option A is wrong because just assigning a policy initiative does not enable automatic remediation; a remediation task is needed.

Option B is wrong because enabling auto-provisioning for Log Analytics deploys the agent, but does not remediate security configurations. Option D is wrong because custom Azure Policy definitions require manual assignment and remediation setup.

Option D is correct: rate limiting throttles requests, policies validate JSON, and OAuth 2.0 secures access. Option A is wrong because Azure Firewall does not integrate with API Management for payload validation. Option B is wrong because WAF protects at the network edge, not per-API.

Option C is wrong because Managed Identity is for authentication, not throttling or validation.

Requiring antivirus (Windows Defender) to be active ensures protection against malware. Requiring encryption (BitLocker) protects data at rest on lost devices. Password length and OS version are important but not the most direct health checks for threat protection.

Jailbreak detection is for mobile devices.

Option B is correct because the rule uses 'Internet' as sourceAddressPrefix, which is a service tag that does not include all public IPs. The actual source IPs may not be covered. Option A is wrong because priority 100 is high enough (lower number = higher priority).

Option C is wrong because the rules are correct for inbound traffic. Option D is wrong because the DenyAllOther rule has a higher priority number (1000) than AllowHTTP (100), so it is evaluated after AllowHTTP.

Using AVNM connectivity and security admin rules allows central management of network groups and firewall policies, ensuring isolation while scaling. Direct peering with route tables is less scalable and lacks central management. NSG on the subnet is not scalable and can be overridden.

Enforcing via Azure Policy with deny is possible but less integrated for network topology.

Option B is correct because Microsoft Defender for Cloud's JIT VM access provides time-bound access to VMs. Option A is incorrect because PIM is for role-based access, not VM access. Option C is incorrect because Azure Bastion provides secure RDP/SSH but not JIT.

Option D is incorrect because NSGs alone do not enforce JIT.

Option A is correct because Azure Firewall with application rules provides L7 filtering, and diagnostic logs capture denied traffic. Option B is wrong because NSGs lack L7 filtering and logging of denied traffic is not as comprehensive. Option C is wrong because Application Gateway is a load balancer, not a firewall for inter-tier traffic.

Option D is wrong because NVAs add complexity and cost without clear benefit over Azure Firewall for this use case.

Option C is correct. The presence of a baseline for rule VA2108 means that previous findings for that rule have been approved, so the rule will not be flagged as a vulnerability in future scans. Option A is wrong because it does not mean automatic remediation.

Option B is wrong because a baseline is set for specific rules, not all. Option D is wrong because vulnerability assessment is still enabled.

Option B is correct because Microsoft Defender for Containers provides image scanning and runtime threat detection integrated with AKS. Option A is wrong because Azure Security Center is now part of Defender for Cloud but the specific plan is Defender for Containers. Option C is wrong because Azure Policy can enforce configurations but not runtime security.

Option D is wrong because Azure Container Registry provides image storage, not scanning.

Option A is correct because Azure Bastion provides secure, RDP/SSH access to VMs without public IPs, and integrates with Entra ID for authentication. Option B is wrong because site-to-site VPN requires network connectivity, not zero-trust. Option C is wrong because Just-in-Time (JIT) VM access reduces exposure but still requires a public IP.

Option D is wrong because NSGs filter by IP, not user identity.

Option D is correct because ExpressRoute with VPN gateway failover provides encrypted connectivity with high availability and automatic failover across regions. Option A is wrong because Site-to-Site VPN alone may not meet high availability requirements. Option B is wrong because ExpressRoute alone does not encrypt traffic by default.

Option C is wrong because Point-to-Site VPN is for individual clients, not site-to-site.

Option B is correct because Azure Policy for Kubernetes can enforce using only images from specific registries via built-in policy 'Ensure only allowed container images'. Option A is wrong because AKS network policies control traffic, not image source. Option C is wrong because Azure Container Registry tasks build images, not enforce usage.

Option D is wrong because Microsoft Defender for Containers provides threat detection, not image authorization.

Option C is correct because Microsoft Intune provides device compliance policies that integrate with Entra ID Conditional Access. Option A is wrong because Microsoft Defender for Cloud Apps is a CASB, not a device management solution. Option B is wrong because Microsoft Purview focuses on data governance.

Option D is wrong because Microsoft Sentinel is a SIEM/SOAR, not a device management tool.

Option D is correct because micro-segmentation with network security groups (NSGs) and Azure Firewall isolates the legacy devices, limiting lateral movement. Option A is wrong because unpatched devices cannot be hardened with Defender for IoT agents. Option B is wrong because TLS is often not supported on legacy PLCs.

Option C is wrong because VPN would expose the devices to more traffic.

Option A, C, and D are correct. Defender for Identity monitors lateral movement paths, reconnaissance attacks, and privilege escalation. Option B is wrong because file integrity monitoring is a feature of Defender for Servers or Azure Policy.

Option E is wrong because network traffic to internet is monitored by Defender for Network or network security groups.

Option A is correct because Azure Policy for AKS, using the built-in 'Kubernetes cluster containers should only use allowed images' policy, ensures that only images from approved registries can run. Option B is wrong because Azure RBAC controls who can manage the cluster, not which containers run. Option C is wrong because network policies control traffic, not container authorization.

Option D is wrong because Azure AD integration controls authentication, not container image approval.

Options B and D are correct. B: Security recommendations provide actionable steps to fix misconfigurations. D: Secure score measures overall security posture and guides prioritization.

Option A is wrong because JIT is for VM access. Option C is wrong because FIM is for file integrity. Option E is wrong because adaptive application controls are for allowed apps.

Option A is correct: Azure Web Application Firewall (WAF) on Application Gateway protects against web vulnerabilities, provides TLS termination, and supports autoscaling. Option B is incorrect: Azure Front Door also provides WAF but is more expensive and suited for global scenarios. Option C is incorrect: Azure CDN does not include WAF.

Option D is incorrect: Azure Firewall is a network firewall, not a web application firewall.

Options A and D are correct because NSGs provide network segmentation and Azure Backup provides data protection. Option B is wrong because Azure Front Door is for global load balancing. Option C is wrong because Azure Logic Apps is an integration service.

Option E is wrong because Azure Automation is for process automation.

Option A is correct because the policy denies creation of VMs that do not use managed disks. The condition checks if the osDisk.managedDisk field does not exist, and if so, denies the request. Therefore, any attempt to create a VM with unmanaged disks will be denied.

Option B is wrong because the policy only denies creation, it does not affect existing VMs. Option C is wrong because the policy denies all VMs without managed disks, not just those with a specific size. Option D is wrong because the policy does not require premium SSDs; it only requires managed disks.

Option A is correct because the Azure Monitor Agent (AMA) can be deployed via Azure Arc to on-premises servers, collecting logs and forwarding them to Sentinel via a Log Analytics workspace. Option B is wrong because the Log Analytics agent (MMA) is being deprecated. Option C is wrong because the Syslog connector typically requires direct connectivity or a forwarder.

Option D is wrong because the Common Event Format (CEF) connector also requires a forwarder with internet access.

Option A is correct because policy definitions are the rules that enforce compliance. Option C is correct because assignment scope defines where the policy applies (e.g., management group, subscription). Option D is correct because parameters allow customization of policy definitions at assignment time.

Option B is wrong because initiative definitions are groups of policies, but the question asks for components of a single policy assignment; an initiative is a separate artifact. Option E is wrong because remediation tasks are actions taken after assignment, not part of the assignment itself.

Option A is correct because the Azure Policy for Kubernetes initiative (preview) includes built-in policies to enforce security constraints like preventing privileged containers. Option B is wrong because Defender for Cloud's workload protection provides monitoring but not policy enforcement. Option C is wrong because Azure RBAC roles control permissions, not container security.

Option D is wrong because AKS Pod Identity is for pod authentication to Azure resources.

Option B is correct because Microsoft Entra Conditional Access policies can enforce access controls based on device compliance, including requiring MFA or blocking access from unmanaged devices. Option A is wrong because Intune enrollment is only for managed devices. Option C is wrong because Microsoft Defender for Endpoint (now part of Defender XDR) provides threat detection but not access policy enforcement.

Option D is wrong because Windows Defender Application Control is for code integrity on managed devices.

Option B is correct because you need to add a virtual network rule to allow traffic from the VNet. The current configuration has no rules, so all traffic is denied. Option A is wrong because the storage account already has public network access disabled.

Option C is wrong because enabling firewall and adding IP rules would allow specific IPs, not a VNet. Option D is wrong because adding a service endpoint alone is incomplete without the rule.

Options A, B, and C are correct. A: Local network gateway represents on-premises VPN device. B: Virtual network gateway (VPN Gateway) is the Azure side.

C: Connection object ties them together with shared key. Option D is wrong because ExpressRoute is a different connectivity method. Option E is wrong because Azure Firewall is not required for VPN.

Option A is correct because the Update rings policy in Intune allows configuring Windows Update settings, including setting deadlines for updates to prevent deferral. Option B is wrong because Compliance policies enforce device compliance but do not control update deferral. Option C is wrong because Device configuration policies are for settings like BitLocker, not update rings.

Option D is wrong because Endpoint security policies include antivirus and firewall, not update rings.

Option C is correct because you must first onboard the AWS/GCP accounts into Defender for Cloud by connecting them via the native cloud connectors. Option A is wrong because deploying Azure Arc agents is for on-premises servers, not cloud accounts. Option B is wrong because enabling Defender plans is done after onboarding.

Option D is wrong because custom policies are optional.

Option B is correct because the data connector for Azure Activity is designed for this purpose. Option A is wrong because manual export is not efficient. Option C is wrong because diagnostic settings export to a Log Analytics workspace, but Sentinel requires the data connector.

Option D is wrong because Logic Apps are unnecessary overhead.

Option D is correct because the policy rule uses an incorrect field path for encryptionAtHost. The correct property path is 'Microsoft.Compute/virtualMachines/securityProfile/encryptionAtHost'. Option A is wrong because the effect is deny, not audit.

Option B is wrong because the policy applies to all VMs, not just those without encryption. Option C is wrong because the deny effect is correctly targeting VMs with encryptionAtHost false, but the field path is wrong.

Option D is correct because Azure Bastion does not require public IPs on VMs nor does it need to traverse the firewall; it uses private IPs and the Bastion host in the same or peered VNet. Option A is wrong because VMs do not need public IPs with Bastion. Option B is wrong because Bastion does not need to go through the firewall; it uses direct private IP connectivity.

Option C is wrong because Bastion does not need a public IP on the VM.

Option B is correct because Azure AD Connect synchronizes identities and passwords with hash synchronization. Option A is wrong because Microsoft Entra Connect is the same as Azure AD Connect. Option C is wrong because AD FS is for federation, not password synchronization.

Option D is wrong because Microsoft Identity Manager is for identity governance, not synchronization.

Correct answers: A, B, D. Azure Policy can evaluate compliance before deployment, Azure Blueprints (or its replacement, deployment stacks) define the desired state, and Azure DevOps pipelines can run pre-deployment checks. Option C is incorrect: Azure Resource Graph is for querying resources, not enforcing.

Option E is incorrect: Azure Monitor is for monitoring, not drift detection.

Windows Security Events from Event ID 4625 (failed logon) are the primary source for detecting brute-force attacks. Azure Activity Log is for resource management events. DNS events are for DNS queries.

Sysmon is for process activity, not logon failures.

Option A is correct because using ExpressRoute with Azure Firewall provides secure, dedicated connectivity and inspection. Option B is correct because forcing tunneling ensures all internet-bound traffic goes through the firewall for inspection. Option C is correct because Azure Bastion eliminates the need for public IPs on VMs.

Option D is wrong because opening all ports to a management subnet violates least privilege. Option E is wrong because a single VPN gateway is a single point of failure.

Option A is correct because automation rules can trigger a playbook that runs a script to isolate the VM. Option B is wrong because analytics rules generate alerts but do not respond. Option C is wrong because workbooks visualize data.

Option D is wrong because hunting queries are for proactive searches.

Option A is correct because GitHub secret scanning automatically detects secrets in repositories. Option B is wrong because Dependabot focuses on dependency vulnerabilities. Option C is wrong because CodeQL analyzes code for security vulnerabilities, not secrets.

Option D is wrong because Defender for Cloud’s DevOps security posture management does not replace secret scanning.

The rule allows HTTP (port 80) to *.microsoft.com, which is unnecessary and could allow unencrypted traffic. HTTPS (port 443) is sufficient. Allowing HTTP could expose traffic to interception.

Additionally, the rule allows all *.microsoft.com subdomains, which might be overly permissive, but the main issue is the inclusion of HTTP.

Option B is correct because using Azure Firewall with fully qualified domain name (FQDN) tags allows you to allow traffic to a specific SaaS endpoint by its FQDN, even if IP addresses change dynamically. Option A is wrong because network rules based on IP addresses cannot handle dynamic IP changes. Option C is wrong because service tags are used for Azure services, not external SaaS endpoints.

Option D is wrong because Azure Firewall Manager is for managing multiple firewalls, not for solving dynamic IP filtering.

Option A is correct because Network Security Groups (NSGs) can be used to filter traffic between subnets. By applying an NSG to the database subnet with a rule allowing inbound traffic only from the front-end subnet's IP range, you restrict access. Option B is wrong because Azure Firewall is a managed firewall service, but for simple subnet-level filtering, NSGs are more appropriate and cost-effective.

Option C is wrong because Application Gateway is a layer 7 load balancer. Option D is wrong because Azure Bastion provides secure RDP/SSH access to VMs.

Option C is correct because the Microsoft Defender XDR connector in Sentinel allows alert streaming and incident creation. Option A is wrong because Microsoft Power Automate can be used but is not the primary integration. Option B is wrong because Logic Apps can automate but the connector is the standard method.

Option D is wrong because Microsoft Graph API is programmatic but not the designed integration.

Option B is correct because Transparent Data Encryption (TDE) encrypts the database at rest, and Dynamic Data Masking (DDM) masks sensitive columns. Option A is wrong because Always Encrypted encrypts columns at the client side, but does not encrypt the database at rest. Option C is wrong because Always Encrypted does not encrypt at rest fully, and TDE plus DDM is the correct combination.

Option D is wrong because cell-level encryption is complex and not native to Azure SQL.

Option D is correct because an analytics rule in Microsoft Sentinel can be configured to alert on specific activities (e.g., access from a certain IP). Option A is wrong because a watchlist is a data source, not an alerting mechanism. Option B is wrong because a playbook is a response action, not an alert trigger.

Option C is wrong because a workbook is a visualization tool.

Option A is correct because using a single workspace across regions avoids duplicate data ingestion and cost. Option C is correct because using Azure Lighthouse allows centralized management across regions. Option B is wrong because multiple workspaces increase cost and management overhead.

Option D is wrong because it doesn't directly address cost optimization. Option E is wrong because separate workspaces increase cost.

Option D is correct because after modifying the subnet configuration with Set-AzVirtualNetworkSubnetConfig, you must apply the changes using Set-AzVirtualNetwork to update the VNet. Without that, the NSG association is not saved. Option A is wrong because the NSG is created and associated to the subnet, but the VNet update is missing.

Option B is wrong because the priority is valid. Option C is wrong because the NSG is applied to the subnet, not the NIC.

Option D is correct: The rule allows HTTP (port 80) from the Internet to the VirtualNetwork address prefix, which effectively allows inbound traffic from any public IP to all VMs in the virtual network on port 80. This is overly permissive. Option A is wrong because the rule allows HTTP, not HTTPS.

Option B is wrong because the rule allows inbound, not outbound. Option C is wrong because the rule allows Internet, not a specific IP.

Sentinel's analytics rules use alert grouping to combine related alerts into a single incident. Option A is correct. Option B is incorrect because automation rules trigger actions but don't group alerts.

Option C is incorrect because watchlists are for reference data. Option D is incorrect because playbooks automate responses, not grouping.

Option B is correct because GitHub Advanced Security includes secret scanning for code repositories. Option C is correct because Azure Key Vault can store secrets accessed during pipeline execution. Option D is correct because Credential Scanner is a Microsoft security tool that is integrated into Azure DevOps for scanning secrets.

Option A is wrong because Azure Artifacts is a package management solution. Option E is wrong because Azure Boards is for work item tracking.

Option A is correct because Microsoft Entra Privileged Identity Management (PIM) provides just-in-time access and approval workflows for Azure roles. Option B is wrong because Conditional Access controls access based on conditions, not just-in-time role activation. Option C is wrong because Azure AD (now Entra ID) roles are managed by PIM.

Option D is wrong because Microsoft Defender for Identity identifies threats to on-premises Active Directory.

Option A is correct because Endpoint security policies in Intune include BitLocker settings that can enforce encryption and store recovery keys in Entra ID. Option B is wrong because Device configuration policies are for general settings, not for BitLocker specifically. Option C is wrong because Compliance policies can check for encryption but do not configure it.

Option D is wrong because Update rings are for Windows Update settings.

Option C is correct because Azure Policy can audit if a subscription has no Defender plans enabled, and then use a remediation task to enable the plans. Option A is wrong because Azure Policy cannot directly enable plans without a remediation task. Option B is wrong because Defender for Cloud's continuous export is for security alerts, not policy enforcement.

Option D is wrong because Azure Blueprints are being deprecated in favor of Azure Policy and deployment stacks.

Option A is correct because Log Analytics workspace is the data store for Sentinel. Option B is correct because the Azure Monitor Agent (AMA) collects logs from Azure VMs. Option D is correct because a data connector for AWS (e.g., AWS CloudTrail) is needed to ingest logs.

Option C is not required because Sentinel itself is the SIEM, not a separate component. Option E is not required because Azure Arc is optional for non-Azure servers but not required for AWS logs.

Option B is correct because Azure Policy allows defining and enforcing security policies across Azure and hybrid environments via Arc-enabled servers. Option A is incorrect because Azure Blueprints are deprecated in favor of deployment stacks. Option C is incorrect because Defender for Cloud's security policies are built on Azure Policy.

Option D is incorrect because Azure Security Benchmark is a set of guidelines, not a configuration mechanism.