Virtual Network Security and Logging GPCS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   When configuring a network security group (NSG) rule, which fields are required to define the traffic that the rule applies to?

   • ASource IP, destination IP, and priority only
   • BSource port, destination port, and protocol only
   • CSource, destination, and action only
   • DSource, destination, port, and protocol
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What type of information is captured in a network security group (NSG) flow log?

   • AThe content of the packets, including payload data
   • BThe DNS queries made by resources in the subnet
   • CThe CPU and memory usage of the virtual machines in the subnet
   • DThe source and destination IP addresses, ports, protocol, and whether the traffic was allowed or denied
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which Azure service is used to collect and store network security group (NSG) flow logs for a virtual network?

   • AAzure Active Directory
   • BAzure DNS
   • CAzure Storage account
   • DAzure Monitor
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is reviewing NSG flow logs and notices that a VM is communicating with an IP address that is on a threat intelligence blocklist. The traffic is being allowed. What should the analyst do?

   • ACreate an NSG rule to deny traffic to that IP address and investigate the VM for potential compromise.
   • BDelete the NSG flow logs to avoid false positives.
   • CChange the VM's IP address to avoid the blocklist.
   • DIgnore the traffic because the VM is a production server and cannot be interrupted.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst is reviewing NSG flow logs from a production VNet and notices a large number of blocked outbound connections from a specific VM to an external IP address on port 443. The VM is a legitimate application server. What is the most likely explanation for this traffic?

   • AThe VM is attempting to communicate with an external service that is not allowed by the NSG outbound rules.
   • BThe VM has been compromised and is part of a botnet sending spam.
   • CThe NSG flow logs are misconfigured and are reporting false positives.
   • DThe VM is receiving unsolicited inbound traffic from the internet on port 443.
   Reveal Solution Discussion Select an answer first