AZ-500 · Domain 2
Secure Networking
About 20% of the exam
Network security groups
- Scope
- applied to subnet or interface
- Priority
- lowest number evaluated first
- Direction
- separate inbound and outbound rules
- Stateful
- return traffic allowed automatically
- Port range
- one rule can span ports
- Service tag
- managed group of provider addresses
- Application security group
- groups machines by their role
- Flow logs
- records allowed and denied flows
The lowest priority number wins, so a permissive rule at one hundred beats a deny rule at two hundred
Service tags and grouping
- Service tags track provider address ranges
- The load balancer tag allows health probes
- The internet tag covers everything outside
- The virtual network tag covers peered space
- Application security groups replace address lists
- Tags reduce rule sprawl considerably
Azure Firewall
- Network rules
- address, port and protocol filtering
- Application rules
- outbound filtering by domain name
- Translation rules
- inbound mapping to internal hosts
- Threat intelligence
- alert or deny known bad addresses
- Firewall policy
- shared rules with parent inheritance
- Firewall Manager
- central policy across many hubs
- Public prefix
- predictable outbound addresses for partners
- Secured hub
- firewall inside a virtual hub
Firewall premium features
- Intrusion detection and prevention signatures
- Inspection reveals the full request path
- Web categories block whole site groups
- Path filtering needs inspection enabled
- A certificate authority signs the inspection
- Diagnostic logs show which rule matched
Web application firewall
- Runs on the gateway or the edge
- Managed rule set covers common exploits
- Detection mode logs without blocking
- Prevention mode blocks matching requests
- Custom rules match headers and addresses
- Exclusions reduce false positives
Private endpoints and service endpoints
Private endpoint
- A private address inside your network
- Traffic never leaves the backbone
- Needs a linked private naming zone
- Disable public access on the service
Service endpoint
- Keeps traffic on the backbone
- The service keeps its public address
- Restrict the resource to that subnet
- Simpler but coarser than private endpoints
Choosing
- Private endpoint for strict isolation
- Endpoint policies limit reachable resources
- Subnet network policies affect filtering
- Cross-region access favors private endpoints
Egress control
- Workload subnet
- User defined route
- Firewall inspection
- Known outbound prefix
- A route table sends everything to inspection
- Default route blackholes direct internet access
- Address translation gateway gives predictable egress
- Advertise a default route over the circuit
- The firewall translates to a known prefix
- Forced tunneling sends traffic back on-premises
Administrative access
- Bastion removes public addresses on hosts
- Browser based shell and desktop sessions
- Higher tiers add native client support
- Higher tiers reach peered networks
- The dedicated subnet needs specific rules
- Just in time access opens ports briefly
Denial of service protection
- Platform level protection exists for everyone
- Network protection covers the whole network
- Address protection covers a few addresses
- Adaptive tuning learns your traffic profile
- Attack metrics show mitigation in progress
- Cost protection for scaling during attack
Hybrid connectivity
- Site to site tunnels over the internet
- Private circuits avoid the public internet
- Encryption still recommended over private circuits
- Hub and spoke centralizes inspection
- Peering is not transitive by itself
- A managed wide area network scales hubs
Network monitoring
- Flow logs record every allowed connection
- Traffic analytics enriches flows with context
- Connection tests verify a path end to end
- Firewall logs show which rule matched
- Alert on protection state changes
- Send everything to the workspace
Networking mistakes
- Deny rule numbered above the allow
- Public access left on the service
- Private naming zone never linked
- Bastion subnet missing required rules
- Peering assumed to give inspection
- No route pointing at the firewall
Rapid recall: pick the control
- Block gambling sites
- firewall web categories
- Inspect encrypted outbound paths
- premium inspection features
- Filter web exploits
- web application firewall
- Private path to a service
- a private endpoint
- Predictable outbound addresses
- translation gateway or firewall
- Admin access without public addresses
- Azure Bastion
- Volumetric flood protection
- network denial protection
- Which rule dropped it
- firewall diagnostic logs
Reference strip: filtering, firewall, private access, edge, operations
Filtering
- Network security group rules
- Lowest priority number wins
- Service and application groups
- Stateful return traffic
Firewall
- Network, application and translation rules
- Threat intelligence based filtering
- Premium inspection and detection
- Central policy across hubs
Private access
- Private endpoints with naming zones
- Service endpoints for subnet scoping
- Public access disabled
- Endpoint policies limit targets
Edge
- Web application firewall modes
- Gateway or global edge
- Denial of service tiers
- Custom rules and exclusions
Operations
- Flow logs and traffic analytics
- Connection troubleshooting tools
- Diagnostics into the workspace
- Forced tunneling where required
Quick exam traps
- Trap: A higher priority number is evaluated first in a network security group
- Trap: A private endpoint resolves correctly without a linked naming zone
- Trap: Service endpoints give the platform service a private address
- Trap: Network security groups inspect the application layer
- Trap: Peering two networks routes their traffic through the hub firewall
- Trap: Detection mode on the web application firewall blocks matching requests
- Trap: Adding a private endpoint automatically disables public access
cybercertprep.com · original revision sheet written from the public body of knowledge