AZ-500: Manage security operation

अब Quizwiz के साथ अपने होमवर्क और परीक्षाओं को एस करें!

You require a Log Analytics workspace if you intend on collecting data from the following sources:

-Azure resources in your subscription -On-premises computers monitored by System Center Operations Manager -Device collections from Configuration Manager -Diagnostics or log data from Azure storage

Microsoft Defender for Cloud Basic features

-Defender for Cloud is enabled for free on all your Azure subscriptions. -Defender for Cloud provides foundational cloud security and posture management (CSPM) features by default. -The foundational CSPM includes a secure score, security policy and basic recommendations, and network security assessment to help you protect your Azure resources.

What is a key feature of Microsoft Sentinel's incident response capabilities?

A key feature of Microsoft Sentinel's incident response capabilities is AI-powered investigation and threat hunting. It leverages artificial intelligence to enhance the efficiency and effectiveness of incident response activities. By leveraging years of real-world cyber security experience, Microsoft Sentinel enables security teams to investigate threats at scale and proactively hunt for suspicious activities.

To be notified when any virtual machine in the production resource group is deleted, what should be configured?

Activity log alert. An activity log alert to receive notifications when specific changes occur to resources in your Azure subscription

Azure monitor Alerts

Alerts in Azure Monitor proactively notify you of critical conditions and potentially attempt to take corrective action. Alert rules based on metrics provide near real time alerting ; rules based on logs allow for complex logic

different ways that you can use Logs in Azure Monitor

Analyze Visualize Alert Retrieve Export

Defender for Cloud helps you detect threats across:

Azure Platform as a Service (PaaS) services Azure data services Networks

Azure Monitor Data collection sources;

Azure resources: Applications: Virtual machine agents: Custom metrics: Kubernetes clusters: common type of log entry is an event

Microsoft Defender for Cloud's features covers the two broad pillars of cloud security:

Cloud Security Posture Management (CSPM) - Remediate security issues and watch your security posture improve Cloud Workload Protection (CWP) - Identify unique workload security requirements

Microsoft Sentinel enables the following service

Collect data at cloud scale Detect previously undetected threats, and minimize false positives Investigate threats with artificial intelligence, and hunt for suspicious activities at scale Respond to incidents rapidly

Microsoft cloud security benchmark features

Comprehensive multi-cloud security framework Automated control monitoring for AWS in Microsoft Defender for Cloud:

MicrosoftDefender for Cloud fills three vital needs

Defender for Cloud secure score continually assesses your security posture Defender for Cloud recommendations secures your workloads with step-by-step actions Defender for Cloud alerts defends your workloads in real-time

if you've connected an Amazon Web Services (AWS) account to an Azure subscription, you can enable any of these protections

Defender for Cloud's CSPM Microsoft Defender for Kubernetes Microsoft Defender for Servers

Practices to blunt a Brute Force Attacks

Disable the public IP address and use one of these connection methods: VPN site-to-site VPN Azure ExpressRoute two-factor authentication Increase password length and complexity Limit login attempts Implement Captcha Limit the amount of time that the ports are open

security recommendation

Each recommendation provides you with the following information: short description remediation steps affected resources

security recommendation details

Enforce and Deny View the policy definition Open query Severity indicator Freshness interval Count of exempted resources Mapping to MITRE ATT&CK tactics and techniques Description relationship types: Prerequisite Alternative Dependent Remediation steps: Affected resources Healthy resources Unhealthy resources Not applicable resources Action buttons to remediate the recommendation

As soon as you open Defender for Cloud for the first time, Defender for Cloud:

Generates a secure score Provides hardening recommendations based on any identified security misconfigurations and weaknesses. Analyzes and secure's your attack paths through the cloud security graph

An organization compliance group requires client authentication using Azure AD and Key Vault diagnostic logs. What is the easiest way to implement the requirement for client authentication?

Implement Microsoft Defender for Cloud policies. Microsoft Defender for Cloud can monitor policy compliance across all your subscriptions using a default set of security policies. A security policy defines the set of recommended controls for resources within the specified subscription or resource group.

Azure Monitor functions

Insights, Visualize, Analyze, Respond, Integrate

When running a query of the Log Analytics workspace, which query language is used?

Kusto Query Language. All data is retrieved from a Log Analytics workspace using a log query written using Kusto Query Language (KQL). You can write your own queries or use solutions and insights that include log queries for an application or service.

Center for Internet Security (CIS) benchmarks provide two levels of security settings

Level 1 recommends essential basic security requirements Level 2 recommends security settings for environments requiring greater security

Data collected by Azure Monitor collects fits into which two fundamental types. What are those types of data?

Logs, Metrics. All data collected by Azure Monitor fits into one of two fundamental types, metrics and logs. Metrics are numerical values that describe some aspect of a system at a point in time. They are lightweight and capable of supporting near real-time scenarios. Logs contain different kinds of data organized into records with different sets of properties for each type. Telemetry such as events and traces are stored as logs in addition to performance data so that it can all be combined for analysis.

Azure Arc provides a centralized, unified way to

Manage your entire environment together by projecting your existing non-Azure and/or on-premises resources into Azure Resource Manager Manage virtual machines, Kubernetes clusters, and databases Use familiar Azure services and management capabilities Continue using traditional IT operations (ITOps) while introducing DevOps practices Configure custom locations as an abstraction layer

What You Can an Azure monitor alert On

Metric values Log search queries Activity log events Health of the underlying Azure platform Tests for website availability

Azure Monitor two fundamental data types used;

Metrics and Logs Azure Monitor collects data via queries data collected from; Application, OS, Resources, Subscriptions, Custom sources, and Tenant

Security tools use of Monitor logs

Microsoft Defender - for Cloud stores data that it collects in a Log Analytics workspace where it can be analyzed with other log data. Azure Sentinel - stores data from data sources into a Log Analytics workspace.

Microsoft Defender feature - Cloud workload dashboard includes the following sections:

Microsoft Defender for Cloud coverage Security alerts Advanced protection Insights

When using Microsoft Defender for Cloud to provide visibility into virtual machine security settings, the monitoring system will notify administrators as issues arise. Which incident below would require a different monitoring tool to discover it?

Microsoft Defender for Cloud doesn't identify newly released operating systems. Microsoft Defender for Cloud examines OS-level settings using a monitor service installed into each Windows and Linux VM. Microsoft Defender for Cloud can also provide a vulnerability assessment with remediation recommendations.

Defender for Cloud Enhanced features

Microsoft Defender for Endpoint Vulnerability assessment for virtual machines, container registries, and SQL resources Multicloud security Hybrid security Threat protection alerts Track compliance with a range of standards Access and application controls Container security feature Breadth threat protection for resources connected to Azure Manage your Cloud Security Posture Management (CSPM)

workbooks to monitor Sentinel data

Microsoft Sentinel allows you to create custom workbooks across your data comes with built-in workbook templates intended for Security operations center (SOC) engineers and analysts of all tiers to visualize data best used for high-level views

What is the primary purpose of Microsoft Sentinel?

Microsoft Sentinel is a security information event management (SIEM) and security orchestration automated response (SOAR) solution. Its primary purpose is to deliver intelligent security analytics and threat intelligence to security operations teams. It helps in alert detection, threat visibility, proactive hunting, and threat response, allowing teams to efficiently identify and respond to cyber threats.

How does Microsoft Sentinel leverage Azure services like Log Analytics and Logic Apps?

Microsoft Sentinel leverages Azure services like Log Analytics and Logic Apps by natively incorporating them as foundational components. Log Analytics provides data collection and storage capabilities, while Logic Apps enables the automation and orchestration of workflows within Microsoft Sentinel.

What benefit does Microsoft Sentinel offer to security operations teams?

Microsoft Sentinel offers multiple benefits to security operations teams. It integrates with various Microsoft products, such as Azure Identity Protection and Microsoft Cloud App Security, and correlates millions of signals. It also incorporates external threat intelligence streams. Additionally, it provides cloud-native scalability and speed, enabling efficient security operations. Furthermore, it offers advanced threat detection and analytics capabilities, helping to minimize false positives and improve threat detection.

The IT managers would like to use a visualization tool for the Azure Monitor results. Each of the following is available, but there is a need to pick the one that will allow for insights and investigation of the data; which should be used?

Monitor Metrics is a feature of Azure Monitor that collects numeric data from monitored resources into a time-series database. Metrics are numerical values collected at regular intervals and describe some aspect of a system at a particular time. Metrics in Azure Monitor are lightweight and capable of supporting near real-time scenarios, so they're useful for alerting and fast detection of issues. You can analyze them interactively by using Metrics Explorer, be proactively notified with an alert when a value crosses a threshold, or visualize them in a workbook or dashboard.

Which tasks are not included in the Microsoft Defender for Cloud free tier?

Monitor non-Azure resources. The Microsoft Defender for Cloud free tier doesn't support monitoring external cloud or non-Azure resources, JIT VM access, compliance reports, adaptive network hardening, and several other features.

Microsoft Sentinel features

More than 100 built-in alert rules Jupyter Notebooks- collection of hunting queries, exploratory queries, and python libraries Investigation graph for visualizing and traversing the connections between entities Microsoft Sentinel GitHub repository over 400 detection, exploratory, and hunting queries, plus Azure Notebooks samples and related Python libraries, playbooks samples, and parsers

Azure Monitor Types of metrics

Native metrics use tools in Azure Monitor for analysis and alerting. -Platform metrics -Custom metrics Prometheus metrics (preview) are collected from Kubernetes clusters, including Azure Kubernetes Service (AKS), and use industry-standard tools for analyzing and alerting, such as PromQL and Grafana.

Which recommendations are included in the secure score calculations?

Only built-in recommendations have an impact on the secure score. Recommendations flagged as Preview aren't included

Azure Monitor Exporting data to a SIEM

Processed events that Microsoft Defender for Cloud produces are published to the Azure activity log offers a consolidated pipeline for routing any of your monitoring data into a SIEM tool This pipe uses the Azure Monitor single pipeline for getting access to the monitoring data from your Azure environment

What is Prometheus?

Prometheus is an open-source toolkit that collects data for monitoring and alerting. multi-dimensional data model with time series data identified by metric name and key/value pairs PromQL- flexible query language to use this dimensionality. Time series collection happens via a pull model over Hypertext Transfer Protocol (HTTP)

Notebooks in Microsoft Sentinel provide

Queries to both Microsoft Sentinel and external data Features for data enrichment, investigation, visualization, hunting, machine learning, and big data analytics Notebooks are best for: -More complex chains of repeatable tasks -Ad-hoc procedural controls -Machine learning and custom analysis

Cloud Security Posture Management (CSPM)

Remediate security issues and watch your security posture improve features provide the following: Hardening guidance Visibility

Uses for diagnostic logs

Save them to a storage account Stream them to event hub Analyze them with Azure Monitor

Microsoft Defender for Cloud tools include

Security governance and regulatory compliance Cloud security graph Attack path analysis Agentless scanning for machines

Azure Arc allows you to manage the following resource types hosted outside of Azure:

Servers Kubernetes clusters Azure data services: SQL Server: Virtual machines (preview)

data connection methods are supported by Microsoft Sentinel:

Service to service integration: Amazon Web Services - CloudTrail Azure Activity Azure AD audit logs and sign-ins Azure AD Identity Protection Azure Advanced Threat Protection Azure Information Protection Microsoft Defender for Cloud Cloud App Security Domain name server Microsoft 365 Microsoft Defender ATP Microsoft web application firewall Windows firewall Windows security events External solutions via API External solutions via an agent

key attributes of an Azure monitor alert rule

Target Resource: Signal Criteria Alert Name Alert Description Severity Action

The Microsoft Defender for Cloud dashboard presents a Secure Score. What is the description of secure score?

The Secure Score is a calculation based on the ratio of healthy resources vs. total resources. Microsoft Defender for Cloud reviews your security recommendations across all workloads, uses algorithms to determine how critical each recommendation is, and calculates a Secure Score which is displayed on the Overview page.

What is the primary benefit of security automation and orchestration in Microsoft Sentinel?

The primary benefit of security automation and orchestration in Microsoft Sentinel is the simplification of security orchestration and the automation of common security tasks. This streamlines security operations, reduces manual effort, and improves overall efficiency.

What data can be sent into an event hub?

Tiers of monitoring data: Application monitoring data Guest OS monitoring data Azure resource monitoring data Azure subscription monitoring data Azure tenant monitoring data

Defender for Cloud offers the following options for working with security initiatives and policies:

View and edit the built-in default initiative Add your own custom initiatives Add regulatory compliance standards as initiatives

An organization is working with an outside agency that needs to access a virtual machine. There's a real concern about brute-force login attacks targeted at virtual machine management ports. Which of the following components would open the management ports for a defined time range?

When just-in-time access is enabled, Microsoft Defender for Cloud uses network security group rules to restrict access to management ports when they aren't in use. Protected ports are the SSH and RDP ports

Microsoft Sentinel

a cloud-native security information and event management (SIEM) platform that uses built-in AI to help analyze large volumes of data across an enterprise—fast.

Microsoft Sentinel's powerful hunting search-and-query tools

based on the MITRE framework, which enable you to proactively hunt for security threats across your organization's data sources before an alert is triggered. Create custom detection rules based on your hunting query. Then, surface those insights as alerts to your security incident responders. While hunting, create bookmarks to return to interesting events later. Use a bookmark to share an event with others or group events with other correlating events to create a compelling incident for investigation.

Sentinel - Automate and orchestrate common tasks by using playbooks

build playbooks with Azure Logic Apps, you can choose from a growing gallery of built-in playbook The connectors allow you to apply any custom logic in code like: ServiceNow Jira Zendesk HTTP requests Microsoft Teams Slack Azure Active Directory Microsoft Defender for Endpoint Microsoft Defender for Cloud Apps Playbooks are intended for Security operations center (SOC) engineers and analysts of all tiers to automate and simplify tasks, including data ingestion, enrichment, investigation, and remediation.

Azure diagnostics extension in Azure Monitor

collect monitoring data from the guest operating system of Azure virtual machines The key differences; Azure Diagnostics Extension can be used only with Azure virtual machines. The Log Analytics agent can be used with virtual machines in Azure, other clouds, and on-premises. Azure Diagnostics extension sends data to Azure Storage, Azure Monitor Metrics (Windows only) and Event Hubs. The Log Analytics agent collects data to Azure Monitor Logs. The Log Analytics agent is required for solutions, Azure Monitor for VMs, and other services such as Microsoft Defender for Cloud.

Microsoft Defender for Cloud security initiatives

collection of Azure Policy definitions or rules that are grouped together towards a specific goal or purpose

Azure Log Analytics agent

comprehensive management across virtual machines send collected data from different sources to your Log Analytics workspace logs or metrics as defined in a monitoring solution

Azure Managed Grafana

data visualization platform fully managed Azure service combine metrics, logs, and traces into a single user interface Following integration features; -Built-in support for Azure Monitor and Azure Data Explorer -User authentication and access control using Azure Active Directory identities -Direct import of existing charts from the Azure portal -all your telemetry data into one place By combining charts, logs, and alerts into one view, you can get a holistic view across multiple datasets. -can share Grafana dashboards

Defender Cloud Security Posture Management (CSPM) plan options

foundational multicloud CSPM capabilities for free includes: asset discovery security recommendations compliance Secure score Defender CSPM plan advanced posture management: Attack path analysis, Cloud security explorer, advanced threat hunting, security governance capabilities o tools to assess your security compliance

Center for Internet Security (CIS)

nonprofit entity whose mission is to identify, develop, validate, promote, and sustain best practice solutions for cyberdefense. It draws on the expertise of cybersecurity and IT professionals from government, business, and academia from around the world Each benchmark undergoes two phases of consensus review; -initial development -consensus team reviews the feedback from the internet community

MITRE ATT&CK matrix knowledge base is organized into several categories

pre-attack, initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, exfiltration, and command and control.

Microsoft cloud security benchmark (MCSB)

prescriptive best practices and recommendations to help improve the security focusing on: Cloud Adoption Framework Azure Well-Architected Framework The Chief Information Security Officer (CISO) Workshop Other industry and cloud service provider's security best practice standards and frameworks; AW CIS NIST PCI-DSS

Azure Monitor diagnostic logs

produced by an Azure service that provide frequently collected data about the operation of that service two types of diagnostic logs; Tenant logs Resource logs other logs: activity log- provides insight into the operations that Azure Resource Manager performed on resources in your subscription using guest operating system (OS)-level diagnostic logs collected by an agent running inside a VM

National Institute of Standards and Technology (NIST)

promotes and maintains measurement standards and guidance to help organizations assess risk.

MITRE ATT&CK matrix

publicly accessible knowledge base for understanding the various tactics and techniques used by attackers during a cyberattack. Tactics (T) represent the "why" Techniques (T) represent "how'" Common Knowledge (CK)

Azure Policy

rule about specific security conditions you want to be controlled

Azure Event Hubs

streaming platform and event ingestion service that can transform and store data by using any real-time analytics provider or batching/storage adapters Use Event Hubs to stream log data from Azure Monitor to a Microsoft Sentinel or a partner SIEM and monitoring tools.

Microsoft Defender for Cloud has two main goals

to help you understand your current security situation to help you efficiently and effectively improve your security central feature in Defender for Cloud that enables you to achieve those goals is the secure score.

Defender for Cloud uses Azure role-based access control (Azure RBAC), which provides built-in roles you can assign to Azure users, groups, and services

two specific roles for Defender for Cloud: Security Administrator: (read/write) update the security policy and dismiss alerts. Security reader: (read) Has rights to view

Log Analytics

writing log queries and interactively analyzing their results

just-in-time (JIT) VM access

you can lock down the inbound traffic to your VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed


संबंधित स्टडी सेट्स

Chapter 5 The Counseling Process

View Set

EMT- Chapter 11- Airway Management

View Set

American Government Exercise quizzes

View Set

RHIT EXAM: PART 10 - INFORMATICS AND INFORMATION SYSTEMS

View Set

Reproductive and genitourinary system, Pharm made easy

View Set

Nursing Concepts 2 Questions Midterm

View Set