Module 4bb - Security and Network Security - Azure Firewall, DDos

Question 1

What is Azure Firewall?

Answer 1

A managed, cloud-based network security service that helps protect provisioned Resources in your AVN (Azure Virtual Networks)

Question 2

What makes Azure Firewall stateful?

Answer 2

Analyzes the complete context of a network connection (not just an individual packet) i.e. it examines the full state of a network connection

Question 3

Why does Azure Firewall use a static public IP Address for AVN Resources?

Answer 3

It enables outside firewalls to identify all traffic COMING FROM that AVN.

Question 4

Azure Firewall as some notable features

1. What’s the most general or common feature given it is hosted in Azure (i.e. what does Azure offer)?
2. What two common Firewall features does it support?
3. What Azure-specific feature does it support (it’s integrated with….)?

Answer 4

1 Like most all Azure Services … High availability, unrestricted cloud scalability

2 In addition to that, Firewall specific features include:

• Inbound/Outbound filtering rules
• Supports inbound Destination Network Address Translation (DNAT)

3 It’s integrated into Azure Monitor for logging and analytics

Question 5

Hint: A FQDN, N, NAT

What three (3) types of Rules can be configured in Azure Firewall?

Answer 5

• Application rules that define FQDNs (fully qualified domain names) that can be accessed from a subnet
• Network rules that define source’s address/protocol/destination and its destination/port address
• NAT (Network Address Translation) rules that define destination IP addresses and ports to translate inbound requests

Question 6

What two entities can Azure Firewall apply to?

Answer 6

Firewall applies connectivity Policies across both Subscriptions and Virtual Networks

Question 7

What does Azure Firewall provide for (both Application AND Network Connectivity) Policies?

Answer 7

Provides a central location to create, enforce and log both Application AND Network connectivity Policies

Question 8

What is a Web Application Firewall (WAF)?

Answer 8

WAFs provide centralized INBOUND protection for web applications against common exploits and vulnerabilities

Question 9

What Azure Services provide a WAF? (name three)

Answer 9

• Azure Front Door (Cloud CDN with additional security features)
• Azure Content Delivery Networks
• Azure Application Gateway

Question 10

What is a Distributed Denial of Service attack? Other than by its definition, what else about DDoS attacks are detrimental to Azure-based applications?

Answer 10

An attack that attempts to overwhelm and exhaust an application’s resources, making it slow and unresponsive. Anything publicly reachable (websites, web services, etc.)

W.r.t. Cloud and auto-scaling, a DDoS attack can blow up your costs by forcing auto-scaling on services

Question 11

What is Azure DDoS Protection?

Answer 11

It’s a service that provides attack mitigation capacity to all Azure Regions

• Sits between your AVN and the Azure Backbone
• Uses scale and elasticity for mitigation
• It identifies and discards DDoS traffic at the network edge before it can affect your services, while allowing customer traffic in without interruption.

Question 12

You can receive credit for auto-scaled out Resources during a DDoS attack (T/F)?

Answer 12

True

Question 13

What is the Basic Tier for DDos Protection?

Answer 13

Basic

• Auto enabled for free
• Always-On monitoring
• Ensures the basic Azure infrastructure is not affected during a large-scale attack
• Azure’s global network is used to distribute/mitigate the attack across Azure Regions

Question 14

What is the Standard Tier for DDoS Protection?

Answer 14

Standard

• Not free but otherwise provides the same features as Basic
• In addition, provides more mitigation capabilities specific to AVNs
• Machine Learning and dedicated traffic monitoring used for tuning protection policies, which are applied to public IP addresses associated to Resources deployed in your AVNs (things like Azure Load Balancer or Application Gateway)

Question 15

Hint: V P R(A)

What three (3) kinds of attack can DDoS Protection help prevent?

Answer 15

• Volumetric attacks: flooding the network layer with substantial traffic
• Protocol attacks: exploiting weaknesses in layer 3 and 4 protocol stacks, rendering the target inaccessible
• Resource (Application) layer attacks: targets web packets to disrupt transmission of data between hosts.

Question 16

How do you protect against L7 attacks?

Answer 16

L7 (Application Layer) attacks require a WAF to protect against. Once in place, DDoS Protection protects the WAF