Exam SC-100 topic 2 question 16 discussion

Selection 1: NSG Selection 2: Microsoft Defender for servers

NSGs: https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/security-control-restrict-unauthorized-network-access/ba-p/1593833

Selection 1: NSG - https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/security-control-restrict-unauthorized-network-access/ba-p/1593833 Selection 2: Defender for servers

For those choosing NSG, you should actually look at the options given in the recommendation under Network Security and you will see clearly that it DOES NOT EXIST. The recommendations are for a Firewall, WAF, etc but not NSG which is applicable at the level of a VNET and not a subscription which may or may not have any vnets.

NSG:Unautorised Network access can be prevented by NSG Microsoft Defender for Server

Box1: NSG Box2: Microsoft Defender for servers

Selection 1: NSG Selection 2: Microsoft Defender for servers Explanation: Question 85 https://www.youtube.com/watch?v=_DvisTemjGQ&list=PLQ2ktTy9rklhzzkSEZvDZT4QSIVUQZD-Y&index=6

I'd have selected WAF but i can see it is under "Protect applications against DDoS attacks" recommendations. NSG is the right for 1st box and MDfS is correct. REF: https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls?branch=main#security-controls-and-their-recommendations

Question in the exam today 19/05/2023

1. NSG 2. Microsoft Defender for servers https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls#security-controls-and-their-recommendations

NSG + MDfS

WAF is incorrect as it only affects level 7 layer of HTTP protocol

1. nsg - ref. 4, https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls?branch=main#how-your-secure-score-is-calculated 2.. defender for endpoint ref 2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls?branch=main#how-your-secure-score-is-calculated

NSG https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/security-control-restrict-unauthorized-network-access/ba-p/1593833

NSG and M$ Defender for Servers

1 and 2, just checked my live environment and NSG is at the top of the list

Quick analysis of https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls tells us that - Restrict unauthorized network access = Virtual networks should be protected by Azure Firewall - Enable endpoint protection = Defender for Cloud checks your organization’s endpoints for active threat detection and response solutions such as [list], [list] shows Defender for Servers and/or Defender for Containers. Therefore answers are: - Azure Web Application Firewall (WAF) - Microsoft Defender for Servers