Azure Infrastructure Security & Defender for Cloud

What is the purpose of a network security group (NSG) in Azure?

• ATo allow or deny network traffic to resources by rules on source, destination and port✓
• BTo encrypt all the data stored inside an Azure storage account
• CTo provide a virtual machine with its operating system updates
• DTo manage which user identities, and groups, may sign in to the Azure portal

Answer: An NSG filters inbound and outbound network traffic to Azure resources using allow and deny rules based on source, destination, port and protocol. It does not encrypt storage, patch VMs or manage identities.

What does Azure DDoS Protection defend against?

• APhishing emails that try to steal a user's sign-in credentials through a fake login page
• BMalware that an unsuspecting user is tricked into downloading and then running on their own device
• CWeak passwords that are easy for an attacker to guess quickly
• DDistributed denial-of-service attacks that try to overwhelm resources with traffic✓

Answer: Azure DDoS Protection mitigates distributed denial-of-service attacks that flood resources with traffic to make them unavailable. Phishing, malware and weak passwords are addressed by other controls.

What is the role of Azure Firewall?

• AA service managing user identities, and their sign-in methods, across the tenant
• BA tool that classifies and labels sensitive documents automatically
• CA backup service that copies virtual machine disks to another region
• DA managed, stateful network firewall that controls traffic across virtual networks✓

Answer: Azure Firewall is a managed, cloud-based stateful firewall that filters network and application traffic centrally across virtual networks. It is not an identity, data-classification or backup service.

What does Azure Bastion provide?

• AAutomatic encryption of every single email message that is ever sent from anywhere in the organization
• BA dashboard showing the compliance score for the whole tenant
• CA way to classify the organization's documents according to their individual sensitivity and content level
• DSecure RDP and SSH access to virtual machines without exposing public IPs✓

Answer: Azure Bastion lets you connect to virtual machines over RDP and SSH securely through the Azure portal, so the VMs need no public IP or exposed management ports. It is unrelated to email encryption, compliance scoring or document classification.

What is Azure Key Vault used for?

• AHosting the organization's public-facing web applications
• BSecurely storing and managing secrets, keys and certificates✓
• CFiltering inbound network traffic heading to a particular subnet according to its port and protocol
• DDetecting and flagging risky or suspicious sign-ins right across all of the organization's user accounts

Answer: Azure Key Vault safeguards cryptographic keys, secrets such as passwords, and certificates, and controls access to them. Web hosting, network filtering and sign-in risk detection are the jobs of other services.

What is the main purpose of Microsoft Defender for Cloud?

• ATo strengthen and monitor the security posture of cloud and hybrid resources✓
• BTo provide email and calendar services for the organization
• CTo store and version-control the organization's source code
• DTo deliver video conferencing and online meetings between remote employees

Answer: Defender for Cloud assesses and improves security posture and provides workload protection across Azure, on-premises and other clouds. It is a security service, not a productivity, source-control or conferencing tool.

What does Cloud Security Posture Management (CSPM) in Defender for Cloud provide?

• AAutomatic payment of the organization's monthly Azure invoices
• BA guarantee that no resource can ever be attacked successfully
• CA dedicated private network connection between two on-premises data centers
• DVisibility into misconfigurations and recommendations to improve security posture✓

Answer: CSPM continuously assesses resources for misconfigurations and weaknesses and provides recommendations, reflected in the secure score, to improve posture. It does not handle billing, guarantee immunity or create network links.

What does the secure score in Microsoft Defender for Cloud represent?

• AThe monthly cost of the security services and Defender plans enabled in your subscriptions
• BA measurement of your security posture based on recommendations you have addressed✓
• CThe total number of users who are currently signed in to the Azure portal across your tenant
• DThe percentage of disk space still free across your virtual machines and managed disks

Answer: Secure score summarizes your security posture as a value that rises as you remediate security recommendations. It is not a cost, sign-in count or storage measure.

How do security policies, standards and recommendations improve cloud security posture?

• AThey automatically delete non-compliant resources as soon as they are detected in a subscription
• BThey grant security teams extra role permissions so they can reconfigure resources in the tenant
• CThey define expected configurations and flag resources that fall short so they can be fixed✓
• DThey hide non-compliant resources from the portal view so administrators see less on-screen clutter

Answer: Policies and standards express the expected secure configuration, and recommendations highlight resources that do not meet them so teams can remediate. They guide improvement rather than deleting resources or hiding problems.

What is provided by the enhanced security features (cloud workload protection) in Defender for Cloud?

• AThreat detection and protection tailored to specific resource types such as servers and storage✓
• BAn antivirus product installed on employees' laptops and personal mobile devices
• CAdditional cloud storage for keeping the organization's backups, included at no extra cost to the tenant
• DA replacement for the organization's identity provider and its user directory service

Answer: Cloud workload protection adds threat detection and advanced defenses for specific workloads, such as servers, storage, databases and containers, through the Defender plans. It is not a laptop antivirus, free storage or an identity provider.

What is network segmentation with Azure virtual networks used to achieve?

• ACombining resources into one flat network so management is simpler
• BIsolating resources into separate networks to limit how far an attacker can move✓
• CEncrypting the contents of databases automatically while they are at rest
• DAssigning job roles and permissions to the organization's users

Answer: Segmenting resources across virtual networks and subnets, with NSGs and firewalls between them, limits lateral movement if one area is compromised. It is about isolation, not consolidation, encryption or identity.