Azure Functions and Windows Containers GCPN Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a recommended defensive measure to secure Windows containers running in Azure?

   • AUsing Hyper-V isolation for containers running untrusted workloads
   • BRunning containers with the '--privileged' flag to improve performance
   • CUsing the default network configuration without any restrictions
   • DDisabling Windows Defender on the host to reduce overhead
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   Your organization is deploying an Azure Function that handles credit card numbers. The function is triggered by an HTTP request and stores data in a Cosmos DB database. You need to ensure that the function's code does not contain hardcoded secrets and that the function can only access the Cosmos DB account. What should you do?

   • AStore the connection string in the function's application settings and use the function's managed identity with the Cosmos DB Data Reader role.
   • BUse Azure Key Vault to store the Cosmos DB connection string and assign the function's managed identity the Contributor role on the Cosmos DB account.
   • CEnable Azure Defender for Cosmos DB to monitor for suspicious activity.
   • DUse a connection string with the account key in the function's code and restrict network access to the Cosmos DB account.
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   An organization runs Windows containers on AKS using a custom VNet. The AKS cluster has an API server that is publicly accessible. The security team wants to reduce the attack surface without losing the ability to manage the cluster from a jump box. Which combination of controls would best achieve this?

   • ARestrict the API server to a private endpoint and allow access only from the jump box's subnet.
   • BDisable the API server's public IP and use Azure Bastion to access the cluster from the jump box.
   • CEnable Azure AD authentication and require multi-factor authentication for all cluster admins.
   • DUse network policies to restrict pod-to-pod traffic within the cluster.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An Azure Function with a Blob trigger is configured with a system-assigned managed identity that has Storage Blob Data Contributor on the storage account. An attacker has found a way to upload a blob that causes the function to execute arbitrary code. What is the most likely impact the attacker can achieve?

   • AAccess other Azure resources that the function's managed identity has permissions on, such as Key Vault secrets.
   • BModify the function's application settings to change the managed identity's role.
   • CRead, write, and delete blobs in the storage account using the function's managed identity.
   • DPerform management-plane operations like creating new storage accounts.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company runs an Azure Function app with an HTTP trigger that processes user-supplied URLs and fetches them server-side. During a review, the security team notes that the function has a system-assigned managed identity with Contributor rights on a storage account. An attacker who can invoke the function could potentially read the storage account's access keys. Which single configuration change would most directly reduce the impact of an SSRF vulnerability in this function?

   • ARemove the managed identity and store the storage account key in the function's application settings.
   • BAdd a network security group rule to block outbound traffic from the function app to internal IP ranges.
   • CReplace the HTTP trigger with a Blob storage trigger and require that all URLs be uploaded as blobs first.
   • DChange the function's managed identity to a user-assigned identity with only Reader role on the storage account.
   Reveal Solution Discussion Select an answer first