Task 3.1: Describe core infrastructure security services in Azure

• AAzure DDoS Protection

  Correct

  DDoS Protection mitigates attacks at layer 3 and layer 4, including volumetric floods.

• BAzure Bastion

  Incorrect

  Bastion provides RDP and SSH to virtual machines without public IP addresses; it doesn't mitigate floods.

• CAzure Web Application Firewall

  Correct

  WAF protects web apps against application-layer DDoS attacks such as HTTP floods.

• DNetwork security groups on the web subnet

  Incorrect

  NSG rules allow or deny traffic by source, port, destination and protocol; they don't absorb a flood.

• EAzure Firewall

  Incorrect

  Azure Firewall filters traffic by its rules; it isn't the DDoS mitigation service for either layer.

Azure DDoS Protection protects at layers 3 and 4. Protection at layer 7 for web applications requires adding a Web Application Firewall, which defends against HTTP floods and other application-layer attacks. Microsoft recommends combining the two, since neither service alone covers all attack vectors.

• AAzure Firewall in a hub virtual network that the others route through

  Correct

  Azure Firewall filters application-layer traffic by FQDN and, deployed on a hub network, controls traffic for VNets across subscriptions.

• BNetwork security groups on every server subnet

  Incorrect

  NSG rules match IP addresses, ports and protocols, not domain names.

• CWeb Application Firewall on Application Gateway

  Incorrect

  WAF protects web applications from incoming exploits; it doesn't filter servers' outbound traffic by domain.

• DAzure DDoS Network Protection on each virtual network

  Incorrect

  DDoS Protection mitigates attack traffic; it doesn't allow or deny destinations.

Azure Firewall is a managed, stateful network security service. It filters network and application traffic, including by fully qualified domain name over HTTP/S. The recommended model is a centralized virtual network that the other virtual and on-premises networks route through, which gives central control across subscriptions; NSGs provide distributed filtering inside each network.

• AA default network security group rule that blocks it, which must be deleted first

  Incorrect

  Default NSG rules can't be removed, only overridden, and the cause here is the separation of the two networks.

• BVirtual networks allow no traffic between them by default; peering would connect them

  Correct

  VNets contain resources with no traffic allowed across VNets by default, and peering connects two of them over the Azure backbone.

• CAzure allows only one of these networks per region in a subscription

  Incorrect

  Organizations can create multiple virtual networks per region per subscription.

• DAzure Firewall blocks all traffic between virtual networks until Azure Bastion is added

  Incorrect

  Bastion provides RDP and SSH access to VMs; it doesn't connect networks.

Azure Virtual Network provides network-level containment: no traffic is allowed across virtual networks or inbound to a virtual network by default, so communication must be explicitly provisioned. Virtual network peering connects two virtual networks, even across regions, and the traffic stays on the Azure backbone.

• AIt's denied, because a deny rule always overrides an allow rule

  Incorrect

  NSG rules aren't evaluated deny-first; the matching rule with the lowest number is the one that applies.

• BIt's allowed, because rule 200 is processed first and processing stops at a match

  Correct

  Rules are processed in priority order, lower numbers first, and later rules aren't evaluated once one matches.

• CIt's denied, because the rule with the higher number takes precedence

  Incorrect

  Higher numbers have lower priority and are processed later, so rule 300 is never reached for this traffic.

• DIt's denied, because the default DenyAllInBound rule is processed before custom rules

  Incorrect

  Default rules have the lowest priority and can be overridden by custom rules with higher priority.

NSG security rules are evaluated by priority using source, source port, destination, destination port and protocol. Rules with lower numbers are processed before rules with higher numbers, and processing stops when traffic matches a rule. The default rules can't be removed but are overridden by custom rules with higher priority (lower numbers).

• AKey Vault Standard tier with access limited to the database team

  Incorrect

  Narrower access changes who may use the keys, but Standard still protects keys in software.

• BKey Vault Standard tier with automatic key rotation

  Incorrect

  Rotation limits exposure over time, but Standard still uses software-based key protection.

• CKey Vault Premium tier with HSM-protected keys for databases

  Correct

  Premium offers keys generated and stored in hardware security modules, for stringent compliance requirements.

• DApp Service application settings, encrypted at rest

  Incorrect

  App settings give the keys no hardware protection, which the regulator requires.

Azure Key Vault has two tiers with the same secrets, key and certificate management. Standard encrypts with software-based key protection. Premium offers HSM-protected keys: a hardware security module generates and stores keys in a tamper-resistant environment that the keys never leave, for organizations with strict compliance requirements.

• AOne per virtual machine

  Incorrect

  Bastion isn't deployed per VM; one deployment serves every VM in its network.

• BOne per subscription

  Incorrect

  Bastion deployment is per virtual network, not per subscription or account.

• COne, in the hub network

  Correct

  Once provisioned in a virtual network, Bastion's RDP and SSH experience is available to VMs in that network and in peered networks.

• DFour, one in each virtual network

  Incorrect

  Peered networks don't need their own deployment, because Bastion supports virtual network peering.

Azure Bastion is a platform-managed PaaS service that you provision inside a virtual network. Its deployment is per virtual network with support for peering, not per subscription, account or VM: once it's in a network, RDP and SSH over TLS are available for all VMs in that network and in peered networks, without public IP addresses on the VMs.

• ABecause the default protection covers only virtual machines, not web apps or gateways

  Incorrect

  The default protection isn't limited by resource type; the issue is its thresholds and lack of visibility.

• BBecause the default protection blocks SQL injection but not floods

  Incorrect

  DDoS protection doesn't block SQL injection.

• CBecause the default protection has high thresholds and no telemetry or alerts

  Correct

  The default protection's thresholds are higher than most applications can handle, and it gives no visibility into attacks; DDoS Protection adds application-specific thresholds and attack telemetry and alerts.

• DBecause the default protection must be renewed every year

  Incorrect

  The default protection doesn't expire; the gap is its thresholds and lack of visibility.

Azure's default infrastructure-level DDoS protection has a higher threshold than most applications can handle and provides no telemetry or alerting, so traffic the platform sees as harmless can still overwhelm an app. Azure DDoS Protection adds application-specific thresholds and telemetry, with attack metrics and alerts.

• ASource network address translation (SNAT)

  Incorrect

  SNAT translates addresses; it doesn't filter traffic against threat intelligence.

• BAvailability zones

  Incorrect

  Availability zones aren't a threat filter.

• CAzure Firewall Manager

  Incorrect

  Firewall Manager applies common policies across many firewalls.

• DThreat intelligence-based filtering

  Correct

  It uses Microsoft's threat intelligence feed to alert on and deny traffic to and from known malicious IPs and domains.

Azure Firewall integrates with Microsoft's threat intelligence feed. With threat intelligence-based filtering enabled, it alerts on and denies traffic from and to known malicious IP addresses and domains. Azure Firewall Basic supports threat intelligence in alert mode only.

• AEach app's code gets patched automatically whenever the WAF rule set is updated

  Incorrect

  A WAF blocks exploit attempts in front of the apps; it doesn't change their code, which developers still fix in due course.

• BA known vulnerability can be mitigated once in the WAF rather than in each app

  Correct

  A centralized WAF lets the team patch a known vulnerability in one place instead of securing each web application, which shortens the window of exposure.

• CThe apps' source code is scanned for the vulnerability before each release

  Incorrect

  Scanning code in repositories and pipelines is DevOps security in Defender for Cloud; a WAF inspects incoming web requests.

• DTraffic to the apps is filtered only by source IP address, port and protocol

  Incorrect

  That's how network security group rules filter traffic; a WAF inspects web requests against rules such as the OWASP core rule set.

Preventing exploits in each application's code takes rigorous maintenance, patching and monitoring. A centralized Web Application Firewall protects the web apps behind it from common exploits and vulnerabilities, so a newly discovered vulnerability can be patched in one place instead of in every app. That simplifies security management and shortens the time the apps stay exposed; developers still fix the code itself.

• AAzure Key Vault

  Correct

  Key Vault stores secrets, keys and certificates with tight access control, and apps retrieve them at runtime.

• BAzure Bastion

  Incorrect

  Bastion provides RDP and SSH to virtual machines; it doesn't store secrets.

• CAzure Firewall

  Incorrect

  Azure Firewall filters network traffic; it doesn't store secrets.

• DNetwork security groups

  Incorrect

  NSGs filter traffic to resources; they don't store secrets.

Azure Key Vault is a cloud service for securely storing and accessing secrets such as API keys, passwords, certificates and cryptographic keys. When developers use it, they no longer store security information in their code: the application retrieves what it needs at runtime, authenticated through Microsoft Entra ID.