AZ-700 Network Security and Compliance 1 — Questions and Answers
Question 1: Which Azure service is used to protect applications from Distributed Denial of Service (DDoS) attacks?
- Azure Traffic Manager
- Azure DDoS Protection (Correct answer)
- Azure Firewall
- Azure Security Center
Correct answer: Azure DDoS Protection
Azure DDoS Protection is a service specifically designed to safeguard Azure applications and resources from Distributed Denial of Service (DDoS) attacks. It provides always-on traffic monitoring and automatic mitigation capabilities to detect and block malicious traffic before it can impact the availability of your services. This ensures business continuity even under attack.
Question 2: What principle is implemented when only the minimum permissions needed to perform a task are granted?
- Defense in Depth
- Role-Based Access Control (RBAC)
- Least Privilege (Correct answer)
- Zero Trust
Correct answer: Least Privilege
The principle of Least Privilege dictates that users, processes, or systems should only be granted the minimum necessary permissions to perform their required tasks. This security best practice reduces the potential impact of a compromise, as an attacker gaining access to a low-privilege account would have limited ability to cause damage. It minimizes the attack surface and improves overall security posture.
Question 3: Which Azure security service allows administrators to set policies for access to Azure resources based on conditions such as user location or device state?
- Azure Policy
- Azure Firewall
- Azure DDoS Protection
- Conditional Access in Azure Active Directory (Correct answer)
Correct answer: Conditional Access in Azure Active Directory
Conditional Access in Azure Active Directory allows administrators to implement policies that control access to Azure resources based on specific conditions. These conditions can include user location, device compliance, application sensitivity, and sign-in risk. This enables organizations to enforce stronger security requirements, such as multi-factor authentication, only when necessary, enhancing security without hindering productivity.
Question 4: Which Azure tool allows you to visualize network security group (NSG) rules to understand their effects on network traffic?
- Azure Monitor
- Azure Sentinel
- Network Watcher (Correct answer)
- Azure Policy
Correct answer: Network Watcher
Azure Network Watcher is a suite of tools designed to monitor, diagnose, and visualize network performance and security in Azure. Specifically, its 'NSG flow logs' and 'IP flow verify' features allow you to visualize and understand how Network Security Group (NSG) rules are affecting network traffic. This helps in troubleshooting connectivity issues and ensuring security policies are correctly applied.
Question 5: In the Zero Trust security model, which of the following is a core concept?
- Allowing all internal traffic by default
- Only authenticating users from internal IP addresses
- Verifying each access request as though it originates from an open network (Correct answer)
- Blocking all traffic to external networks by default
Correct answer: Verifying each access request as though it originates from an open network
A core concept of the Zero Trust security model is 'never trust, always verify.' This means that every access request, whether from inside or outside the network, is treated as if it originates from an untrusted environment. It requires strict identity verification, device validation, and least privilege access for every connection, rather than assuming trust based on network location.
AZ-700 Network Security and Compliance 1
Which Azure service is used to protect applications from Distributed Denial of Service (DDoS) attacks?