Microsoft - AZ-801: Configuring Windows Server Hybrid Advanced Services

Sample Questions

Explanation:

Azure Disk Encryption uses Azure Key Vault to control and manage disk encryption keys and secrets. 

If you want to use a key encryption key (KEK) for an additional layer of security for encryption keys, add a KEK to your key vault. When a key encryption key (KEK) is specified, Azure Disk Encryption uses that key to wrap the encryption secrets (Azure Disk Encryption artifacts) before writing to Key Vault. Use the Azure CLI az keyvault key create command to generate a new KEK and store it in your key vault.

Example: 

az keyvault key create --name "myKEK" --vault-name "<your-unique-keyvault-name>" --kty RSA --size 4096

Reference: Create and configure a key vault for Azure Disk Encryption on a Windows VM

• Core isolation
• Force randomization form images (Mandatory ASLR)

Explanation:

Core isolation including Memory integrity is managed under the Device security tile in Windows Security.

To force Address Space Layout Randomization (ASLR) for all executables on Windows Server, navigate to Windows Security\ App & browser control\ Exploit protection settings, and then set "Force randomization for images (Mandatory ASLR)" to "On by default". This setting applies system-wide but may cause compatibility issues with older applications that don't fully support ASLR.

References:

Enable virtualization-based protection of code integrity

Customize exploit protection

Explanation:

You can configure Microsoft Defender SmartScreen to block suspicious content entirely, or show users a warning but allow them to continue to load the content.

The Configure Windows Defender SmartScreen setting allows you to turn Windows Defender SmartScreen on or off.  SmartScreen helps protect PCs by warning users before running potentially malicious programs downloaded from the Internet.  This warning is presented as an interstitial dialog shown before running an app that has been downloaded from the Internet and is unrecognized or known to be malicious.  No dialog is shown for apps that do not appear to be suspicious.

Some information is sent to Microsoft about files and programs run on PCs with this feature enabled.

If you enable this policy, SmartScreen will be turned on for all users.  Its behavior can be controlled by the following options:

• Warn and prevent bypass
• Warn

If you enable this policy with the "Warn and prevent bypass" option, SmartScreen's dialogs will not present the user with the option to disregard the warning and run the app.  SmartScreen will continue to show the warning on subsequent attempts to run the app.

The Configure App Install Control setting is a feature of Windows Defender SmartScreen that helps protect PCs by allowing users to install apps only from the Store.  SmartScreen must be enabled for this feature to work properly.

If you enable this setting, you must choose from the following behaviors:

• Turn off app recommendations
• Show me app recommendations
• Warn me before installing apps from outside the Store
• Allow apps from Store only

If you disable or don't configure this setting, users will be able to install apps from anywhere, including files downloaded from the Internet.

Reference: Available Microsoft Defender SmartScreen settings

• Minimize risks associated with the Domain Admins group and privilege escalation on the domain.
• Ensure that the built-in administrator account can perform forest recovery operations.
• Reduce the attack surface of the Domain Admins groups.
• Follow the principle of least privilege.

Explanation:

As is the case with the Enterprise Admins (EA) group, membership in the Domain Admins (DA) group should be required only in build or disaster recovery scenarios. There should be no day-to-day user accounts in the DA group with the exception of the built-in Administrator account for the domain. 

To minimize risks associated with the Domain Admins group and privilege escalation on the domain and to ensure that the built-in administrator account can perform forest recovery operations, we should remove all accounts except for the built-in administrator account from the domain admins group. To reduce the risk of the built-in Administrator account gets compromised, we should rename the account using the Accounts:Rename administrator account security option.

In GPOs linked to OUs containing member servers and workstations in each domain, the DA group should be added to the following user rights in Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignments:

• Deny access to this computer from the network
• Deny log on as a batch job
• Deny log on as a service
• Deny log on locally
• Deny log on through Remote Desktop Services 

Reference: Appendix F: Securing Domain Admins Groups in Active Directory

Explanation:

Azure Disk Encryption uses Azure Key Vault to control and manage disk encryption keys and secrets. 

The first step is to create an Azure Key Vault.

The second step is to add a KEK to your key vault. When a key encryption key is specified, Azure Disk Encryption uses that key to wrap the encryption secrets before writing to Key Vault.

Use the Azure PowerShell Add-AzKeyVaultKey cmdlet to generate a new KEK and store it in your key vault as shown below:

Add-AzKeyVaultKey -Name "myKEK" -VaultName "<your-unique-keyvault-name>" -Destination "HSM" -Size 4096

To actually encrypt the disks, you will supply the ID of your KEK key Vault and the URL of your KEK to the Azure PowerShell Set-AzVMDiskEncryptionExtension -KeyEncryptionKeyVaultId and -KeyEncryptionKeyUrl parameters. This example assumes that you are using the same key vault for both the disk encryption key and the KEK.

$KeyVault = Get-AzKeyVault -VaultName "<your-unique-keyvault-name>" -ResourceGroupName "myResourceGroup"
$KEK = Get-AzKeyVaultKey -VaultName "<your-unique-keyvault-name>" -Name "myKEK"

Set-AzVMDiskEncryptionExtension -ResourceGroupName MyResourceGroup -VMName "MyVM" -DiskEncryptionKeyVaultUrl $KeyVault.VaultUri -DiskEncryptionKeyVaultId $KeyVault.ResourceId -KeyEncryptionKeyVaultId $KeyVault.ResourceId -KeyEncryptionKeyUrl $KEK.Id -SkipVmBackup -VolumeType All

Reference: Create and configure a key vault for Azure Disk Encryption on a Windows VM