Security pillar principles in Azure - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable network security group on a subnet in Azure.

Azure

resource "azurerm_subnet_network_security_group_association" "example" {
  subnet_id                 = azurerm_subnet.example.id
  network_security_group_id = [1]
}

Drag options to blanks, or click blank then click option'

Aazurerm_network_security_group.example.id

Bazurerm_virtual_network.example.id

Cazurerm_subnet.example.id

Dazurerm_resource_group.example.id

Attempts:

3 left

💡 Hint

Common Mistakes

Using the virtual network ID instead of the network security group ID.

Using the subnet ID for the network security group field.

The network_security_group_id must reference the ID of the network security group resource to associate it with the subnet.

2fill in blank

medium

Complete the code to enable encryption at rest for an Azure Storage Account.

Azure

resource "azurerm_storage_account" "example" {
  name                     = "examplestorageacct"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"

  [1] {
    services {
      blob {
        enabled = true
      }
    }
    key_source = "Microsoft.Storage"
  }
}

Drag options to blanks, or click blank then click option'

Anetwork_rules

Baccess_tier

Cencryption

Dblob_properties

Attempts:

3 left

💡 Hint

Common Mistakes

Using network_rules block which controls network access, not encryption.

Using access_tier which controls performance tier.

The encryption block enables encryption at rest for the storage account.

3fill in blank

hard

Fix the error in the Azure role assignment code to grant a user Reader access to a resource group.

Azure

resource "azurerm_role_assignment" "example" {
  scope                = azurerm_resource_group.example.id
  role_definition_name = [1]
  principal_id         = var.user_object_id
}

Drag options to blanks, or click blank then click option'

A"User Access Administrator"

B"Contributor"

C"Owner"

D"Reader"

Attempts:

3 left

💡 Hint

Common Mistakes

Using Contributor which allows write access.

Using Owner which grants full control.

The role_definition_name must be set to "Reader" to grant read-only access.

4fill in blank

hard

Fill both blanks to configure an Azure Key Vault access policy granting secret get and list permissions to a user.

Azure

resource "azurerm_key_vault_access_policy" "example" {
  key_vault_id = azurerm_key_vault.example.id
  tenant_id    = var.tenant_id
  object_id    = var.user_object_id

  [1] = ["get", "list"]
  [2] = []
}

Drag options to blanks, or click blank then click option'

Asecret_permissions

Bkey_permissions

Ccertificate_permissions

Dstorage_permissions

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing key permissions with secret permissions.

Granting permissions in the wrong permission block.

The secret_permissions block defines permissions for secrets, and key_permissions is set to empty as no key permissions are granted.

5fill in blank

hard

Fill all three blanks to define an Azure Policy assignment that enforces HTTPS traffic on a storage account.

Azure

resource "azurerm_policy_assignment" "example" {
  name                 = "enforce-https"
  scope                = azurerm_storage_account.example.id
  policy_definition_id = [1]

  parameters = {
    effect = {
      value = [2]
    }
  }

  description = [3]
}

Drag options to blanks, or click blank then click option'

A"/providers/Microsoft.Authorization/policyDefinitions/StorageAccountHttpsOnly"

B"Audit"

C"Enforces HTTPS traffic on storage accounts"

D"Deny"

Attempts:

3 left

💡 Hint

Common Mistakes

Using the wrong policy definition ID.

Setting effect to Audit instead of Deny.

Omitting the description or using unclear text.

The policy_definition_id must point to the built-in policy for HTTPS enforcement. The effect is set to "Deny" to block non-HTTPS traffic. The description explains the policy purpose.

Practice

1. Which of the following best describes the main goal of the Security pillar in cloud architecture?

easy

A. Optimize cloud costs and resource usage

B. Protect cloud resources from threats and unauthorized access

C. Improve application performance and scalability

D. Automate deployment and infrastructure management

Solution

1. Step 1: Understand the purpose of the Security pillar

   The Security pillar focuses on protecting cloud resources from threats and unauthorized access.

2. Step 2: Compare with other cloud pillars

   Other pillars like Cost Optimization or Performance Efficiency focus on costs and performance, not security.

3. Final Answer:

   Protect cloud resources from threats and unauthorized access -> Option B

4. Quick Check:

   Security pillar = Protect resources [OK]

Hint: Security pillar means protecting resources from threats [OK]

Common Mistakes:

• Confusing security with cost or performance
• Thinking security is only about firewalls
• Ignoring access control as part of security

2. Which Azure service is primarily used to manage user identities and control access to resources securely?

easy

A. Azure Active Directory

B. Azure Monitor

C. Azure Blob Storage

D. Azure DevOps

Solution

1. Step 1: Identify the service for identity and access management

   Azure Active Directory (Azure AD) manages user identities and access control.

2. Step 2: Eliminate unrelated services

   Azure Monitor is for monitoring, Blob Storage is for data storage, DevOps is for development pipelines.

3. Final Answer:

   Azure Active Directory -> Option A

4. Quick Check:

   Identity management = Azure AD [OK]

Hint: Azure AD controls user access and identities [OK]

Common Mistakes:

• Choosing monitoring or storage services for access control
• Confusing Azure AD with Azure DevOps
• Ignoring identity management as part of security

3. Consider this Azure policy snippet that denies public IP assignment to virtual machines:

{
  "if": {
    "field": "Microsoft.Network/publicIPAddresses/ipAddress",
    "exists": true
  },
  "then": {
    "effect": "deny"
  }
}

What is the expected behavior when a user tries to assign a public IP to a VM?

medium

A. The assignment is denied and blocked by the policy

B. The assignment is allowed without restrictions

C. The assignment is allowed but logged for review

D. The assignment triggers an alert but proceeds

Solution

1. Step 1: Analyze the policy condition

   The policy checks if a public IP address exists on the resource.

2. Step 2: Understand the policy effect

   The effect is set to "deny", which blocks the action if the condition is true.

3. Final Answer:

   The assignment is denied and blocked by the policy -> Option A

4. Quick Check:

   Policy effect 'deny' blocks public IP assignment [OK]

Hint: Policy with 'deny' effect blocks matching actions [OK]

Common Mistakes:

• Confusing 'deny' with 'audit' or 'allow'
• Assuming the assignment is allowed but logged
• Ignoring the policy effect field

4. You wrote this Azure Role-Based Access Control (RBAC) assignment JSON:

{
  "roleDefinitionId": "/subscriptions/12345/providers/Microsoft.Authorization/roleDefinitions/",
  "principalId": "12345678-1234-5678-9abc-def012345678",
  "scope": "/subscriptions/12345/resourceGroups/myRG"
}

Why does this assignment fail to grant access?

medium

A. The principalId is empty, so no user or group is assigned

B. The scope is invalid because resource group names cannot be used

C. The roleDefinitionId is missing the role GUID

D. The JSON format is incorrect and missing commas

Solution

1. Step 1: Check the roleDefinitionId completeness

   The roleDefinitionId must include the full GUID of the role after /roleDefinitions/.

2. Step 2: Verify other fields

   The principalId and scope are properly formatted; the issue is the incomplete roleDefinitionId.

3. Final Answer:

   The roleDefinitionId is missing the role GUID -> Option C

4. Quick Check:

   RoleDefinitionId needs full GUID [OK]

Hint: RoleDefinitionId must include full role GUID [OK]

Common Mistakes:

• Ignoring missing role GUID in roleDefinitionId
• Blaming the principalId instead of roleDefinitionId
• Thinking resource group names are invalid scopes

5. You want to design a secure Azure environment that automatically detects threats, controls access, encrypts data, and prepares for incidents. Which combination of Azure services best supports the Security pillar principles?

hard

A. Azure Virtual Machines, Azure Load Balancer, Azure Traffic Manager, Azure CDN

B. Azure DevOps, Azure Blob Storage, Azure Functions, Azure Monitor

C. Azure Logic Apps, Azure Cosmos DB, Azure App Service, Azure Automation

D. Azure Security Center, Azure Active Directory, Azure Key Vault, Azure Sentinel

Solution

1. Step 1: Identify services for threat detection and monitoring

   Azure Security Center and Azure Sentinel provide threat detection and security monitoring.

2. Step 2: Identify services for access control and data encryption

   Azure Active Directory manages access; Azure Key Vault secures encryption keys and secrets.

3. Step 3: Confirm the combination supports incident preparation

   Azure Sentinel helps with incident response and investigation.

4. Final Answer:

   Azure Security Center, Azure Active Directory, Azure Key Vault, Azure Sentinel -> Option D

5. Quick Check:

   Security services combo = Azure Security Center, Azure Active Directory, Azure Key Vault, Azure Sentinel [OK]

Hint: Combine security monitoring, access, encryption, and incident tools [OK]

Common Mistakes:

• Choosing unrelated services like DevOps or CDN
• Ignoring encryption or access control services
• Confusing monitoring with deployment tools