Microsoft - SC-100: Microsoft Cybersecurity Architect

Sample Questions

• Minimize the number of security principals that can access Vault1.
• Minimize the storage of sensitive data on the virtual machines.
• Minimize administrative effort.

Explanation:

The Azure Instance Metadata Service (IMDS) provides information about currently running virtual machine instances. IMDS is a REST API that's available at a well-known, non-routable IP address (169.254.169.254). You can only access it from within the VM. Communication between the VM and IMDS never leaves the host. IMDS allows the VM to retrieve an access token for its system-assigned managed identity without storing credentials.

A system-assigned managed identity ensures that only the VM can use the identity to request tokens from Microsoft Entra ID and minimizes administrative effort. A system-assigned managed identity is tied to the lifecycle of the Azure resource it belongs to. When the Azure resource is deleted, Azure automatically deletes the managed identity.

References:

Azure Instance Metadata Service

What are managed identities for Azure resources?

• Minimize how long it takes to apply operating system updates once the updates are released.
• Minimize administrative effort.

Explanation:

As a cluster operator, you need to have a plan for keeping your clusters up to date and monitoring Kubernetes API changes and deprecations over time.

There are three types of updates for AKS, and each one builds on the previous update:

Update types

• Node OS security patches (Linux only): For Linux nodes, both Canonical Ubuntu and Azure Linux make operating system security patches available once a day. Microsoft tests and bundles these patches in the weekly updates to node images.

• Weekly updates to node images: AKS provides weekly updates to node images. These updates include the latest OS and AKS security patches, bug fixes, and enhancements. Node updates don't change the Kubernetes version. Versions are formatted by date (for example, 202311.07.0) for Linux and by Windows Server OS build and date (for example, 20348.2113.231115) for Windows.

• Quarterly Kubernetes releases: AKS provides quarterly updates for Kubernetes releases. These updates enable AKS users to use the latest Kubernetes features and enhancements, such as security patches and node image updates.

Reference: Azure Kubernetes Service patch and upgrade guidance

• Maintain access to the apps in the event of a region outage.
• Minimize the number of resources required.

Explanation:

Azure Front Door is Microsoft's advanced cloud Content Delivery Network (CDN) designed to provide fast, reliable, and secure access to your applications' static and dynamic web content globally. By using Microsoft's extensive global edge network, Azure Front Door ensures efficient content delivery through numerous global and local points of presence (PoPs) strategically positioned close to both enterprise and consumer end users.

Azure Web Application Firewall on Azure Front Door provides centralized protection for your web applications. A web application firewall (WAF) defends your web services against common exploits and vulnerabilities. It keeps your service highly available for your users and helps you meet compliance requirements.

Azure Front Door integrates with Azure Web Application Firewall (WAF) that supports the Core Rule Set (CRS) from the Open Web Application Security Project (OWASP).

Note: Azure Application Gateway can't route traffic across regions. Since we need to minimize the number of resources required, we should choose Azure Front Door over Azure Application Gateway.

References:

What is Azure Front Door?

Azure Web Application Firewall on Azure Front Door

Explanation:

Multi-user authorization (MUA) for Azure Backup allows you to add an additional layer of protection to critical operations on your Recovery Services vaults and Backup vaults. For MUA, Azure Backup uses another Azure resource called the Resource Guard to ensure critical operations are performed only with applicable authorization.

Azure Backup uses the Resource Guard as an additional authorization mechanism for a Recovery Services vault or a Backup vault. Therefore, to perform a critical operation (described below) successfully, you must have sufficient permissions on the associated Resource Guard as well.

Before you configure Multi-user authorization for a Recovery Services vault, ensure that the following prerequisites are met:

• The Resource Guard and the Recovery Services vault must be in the same Azure region.

• The Backup admin must not have Contributor, Backup MUA Admin, or Backup MUA Operator permissions on the Resource Guard. You can choose to have the Resource Guard in another subscription of the same directory or in another directory to ensure maximum isolation.

• The subscriptions containing the Recovery Services vault as well as the Resource Guard (in different subscriptions or tenants) must be registered to use the providers - Microsoft.RecoveryServices and Microsoft.DataProtection

References:

About Multi-user authorization using Resource Guard

Configure Multi-user authorization using Resource Guard in Azure Backup

Explanation:

To export historical data from a Microsoft Sentinel workspace to Azure Data Lake Storage (ADLS) either one-time or continuously, you can make use of the new historical data export notebook. The new notebook approach allows for more granular control over the export process compared to the previously used Sentinel data export tool.

The historical data export notebook provides the ability to filter and transform data before exporting it to ADLS.

The historical data export notebook uses Azure Synapse to work with data at scale.

The template notebook is available via the Sentinel UI or from GitHub.

References:

Export Historical Log Data from Microsoft Sentinel

Export data from sentinel to external systems