GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

3 - Storage security

Archimed Nemes Azure AZ-104 Easy English 44 cards

Cards in this deck (44)

  1. 1What are storage capabilities that Azure provide?Encryption
    Authentication
    Data in transit
    Disk encryption
    Shared Access Signatures
  2. 2How data is encrrypted in Azure?All data written to Azure Storage is automatically encrypted using Storage Service Encryption
  3. 3What type of authentication for Azure Storage?Azure Active Directory (Azure AD) and Role-Based Access Control (RBAC)
  4. 4How can you use RBAC and Azure AD for security?You can assign RBAC roles scoped to the storage account to security principals and use Azure AD to authorize resource management operations such as key management.
  5. 5For which operations Azure AD integration is supported?Azure AD integration is supported for data operations on the Blob and Queue services.
  6. 6How can data in transit be secured?Data can be secured in transit between an application and Azure by using Client-Side Encryption, HTTPS, or SMB 3.0.
  7. 7How are disks encrypted?OS and data disks used by Azure virtual machines can be encrypted using Azure Disk Encryption.
  8. 8Explain shared access signatures.Delegated access to the data objects in Azure Storage can be granted using Shared Access Signatures.
  9. 9What authorization options are available?Azure AD, shared key, shared access signatures, anonymous access to containers and blobs
  10. 10Explain Azure AD.Azure AD is Microsoft's cloud-based identity and access management service. With Azure AD, you can assign fine-grained access to users, groups, or applications via role-based access control
  11. 11Explain shared key.Shared Key authorization relies on your account access keys and other parameters to produce an encrypted signature string that is passed on the request in the Authorization header.
  12. 12Explain shared access signatures.Shared access signatures (SAS) delegate access to a particular resource in your account with specified permissions and over a specified time interval.
  13. 13EXplain Anonymous access to containers and blobs.IWith this option, a public container or blob is accessible to any user for anonymous read access. Read requests to public containers and blobs do not require authorization.
  14. 14When is Shared Access Signature recommended?You can provide a SAS to clients who shouldn't have access to your storage account key. By distributing a SAS URI to these clients, you grant them access to a resource for a specified period of time. SAS is a secure way to share your storage resources without compromising your account keys.
  15. 15Provide examples of authoization with SAS.An account-level SAS can delegate access to multiple storage services. For example, blob, file, queue, and table.
    a SAS for a blob might grant read and write permissions to that blob, but not delete permissions.
  16. 16What are types of SAS?Account and service
  17. 17What is difference between account and service SAS?The account SAS delegates access to resources in one or more of the storage services. The service SAS delegates access to a resource in just one of the storage services.
  18. 18How can you use IP and HTTPS for SAS?Specify an IP address or range of IP addresses from which Azure Storage will accept the SAS. For example, you might specify a range of IP addresses belonging to your organization.
    The protocol over which Azure Storage will accept the SAS. You can use this optional parameter to restrict access to clients using HTTPS.
  19. 19What is stored access policy?A stored access policy can provide another level of control over service-level SAS on the server side. You can group shared access signatures and provide other restrictions by using policy.
  20. 20How is URI created when SAS is created?When you create your SAS, a URI is created using parameters and tokens. The URI consists of your Storage Resource URI and the SAS token.
  21. 21Explain Resource URI ( https://myaccount.blob.core.windows.net/?restype=service&comp=properties)The Blob service endpoint, with parameters for getting service properties (when called with GET) or setting service properties (when called with SET).
  22. 22Explain Storage services version parameter of URI (sv=2015-04-05)For storage services version 2012-02-12 and later, this parameter indicates the version to use.
  23. 23Explain services parameter of URI (ss=bf)The SAS applies to the Blob and File services
  24. 24Explain resource type parameter of URI. (srt=s)The SAS applies to service-level operations.
  25. 25Explain start time of URI (st=2015-04-29T22%3A18%3A26Z)Specified in UTC time. If you want the SAS to be valid immediately, omit the start time.
  26. 26Explain expiry time of URI (se=2015-04-30T02%3A23%3A26Z)Specified in UTC time
  27. 27Explain Resource parameter of URI (sr = b)The resource is a blob
  28. 28Explain permissions parameter of URI (sp=rw)The permissions grant access to read and write operations.
  29. 29Explain IP range parameter of URI. (sip=168.1.5.60-168.1.5.70)The range of IP addresses from which a request will be accepted.
  30. 30Explain protocol parameter of URI (spr = https)Only requests using HTTPS are permitted.
  31. 31Explain signature parameter of URI (sig=F%6GRVAZ5Cdj2Pw4tgU7IlSTkWgn7bUkkAg8P6HESXwmf%4B)Used to authenticate access to the blob. The signature is an HMAC computed over a string-to-sign and key using the SHA256 algorithm, and then encoded using Base64 encoding.
  32. 32Explain Storage Service EncryptionSSE automatically encrypts your data before persisting it to Azure-managed Disks, Azure Blob, Queue, Table storage, or Azure Files, and decrypts the data before retrieval.
  33. 33What is type of encryption used in Azure?256-bit AES
  34. 34What are transparent to userrs in terms of encryption?SSE encryption, encryption at rest, decryption, and key management are transparent to users.
  35. 35What is key type used for encryption by default?Microsoft Managed Keys
  36. 36What is another key type for encryption?Customer managed key
  37. 37Explain SSE in terms of new and old data.After enabling SSE only new data will be enabled and exisitng data will be encrypted by a background encryption process
  38. 38Can SSE be disabled?No
  39. 39How can Azure Key Vault be used in ecrryption process?You can create your own encryption keys and store them in a key vault, or you can use Azure Key Vault's APIs to generate encryption keys.
  40. 40What can you do with customer maaged keys?You can create, disable, audit, rotate, and define access controls.
  41. 41What is written in note for customer managed key?Customer-managed keys can be used with SSE. You can use either a new or existing key vault and key. The storage account and the key vault must be in the same region, but they can be in different subscriptions.
  42. 42What is first risk when when you use SAS in applications?If a SAS is compromised, it can be used by anyone who obtains it.
  43. 43What is second risk when you use SAS in application?If a SAS provided to a client application expires and the application is unable to retrieve a new SAS from your service, then the application's functionality may be hindered.
  44. 44—

Information

Description
Easy Azure AZ-104 Flashcards on 3 - Storage security, created by Archimed Nemes on 04/11/2021.
Created by
Archimed Nemes
Views
0
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?