Virtual Network Security and Logging GPCS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst is reviewing NSG flow logs and notices that a VM is receiving a high number of connection attempts on port 3389 from various IP addresses. The VM is a web server that should not accept RDP connections. What should the analyst do?

   • AImmediately shut down the VM to stop the connection attempts.
   • BReview the NSG rules to see if RDP is allowed from the internet, and if so, remove or modify the rule to block RDP from the internet.
   • CChange the VM's RDP port to a non-standard port.
   • DEnable Azure Bastion for RDP access to the VM.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is investigating a potential data exfiltration incident. They review NSG flow logs and see a large volume of outbound traffic from a VM to an IP address in a foreign country on port 443. The VM is a web server that should only communicate with internal resources. What should the analyst do first?

   • ADisable the VM's network interface.
   • BIgnore the traffic because it is on port 443, which is encrypted and cannot be inspected.
   • CCheck if the outbound traffic is expected by reviewing the application's dependencies and recent changes.
   • DImmediately block the IP address in the NSG.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has enabled NSG flow logs for all subnets in a VNet and is sending them to a Log Analytics workspace. The security team wants to detect potential data exfiltration by identifying large outbound transfers to unusual destinations. They have set up a query that looks for flows with high byte counts. However, they are missing some flows because the flow logs are not capturing all traffic. What is the most likely reason?

   • AThe Log Analytics workspace retention is set too low, causing older logs to be deleted.
   • BThe flow logs are only enabled for the subnet, not for the NICs, so some traffic is not logged.
   • CNSG flow logs are sampled and may not capture every flow, especially short-lived connections.
   • DNSG flow logs only capture traffic that is denied by the NSG, not allowed traffic.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A financial services company is required to log all network traffic to and from its payment processing VMs. The VMs are in a VNet with multiple subnets. The compliance team wants to ensure that all traffic is logged, including traffic between VMs in the same subnet. What should the company configure?

   • AEnable NSG flow logs on all NSGs associated with the subnets and NICs that contain the payment VMs.
   • BEnable VNet flow logs on the VNet to capture all traffic regardless of NSG association.
   • CEnable diagnostic settings on each VM to capture network traffic logs.
   • DDeploy a network virtual appliance (NVA) and mirror all traffic to it for logging.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is required to audit all changes to network security group rules for compliance. Which Azure service should they use to track and alert on NSG rule changes?

   • AAzure Monitor metrics
   • BAzure Activity Log with alert rules
   • CNSG flow logs
   • DAzure Policy
   Reveal Solution Discussion Select an answer first