Category: Microsoft Azure Exams

Azure DDoS protection, Microsoft Azure Exams

Thought exercise – Azure Management Tools

Thought exercise

In this exercise, we will look at our fictitious company, MilesBetter Pizza.

Due to the success of the online pizza delivery service and app, they now need to look at the management tools and understand when to choose one tool over another.

As we have learned, there are two approaches to management tools: GUI and CLI. Which one you choose is horses for courses; that is, better tasks are better suited to different tools.

Whether you use the browser-based portal, the desktop, or the Azure mobile app, the GUI approach is the most common way to interact with Azure resources. It’s simple, intuitive, and has the quickest time to value and the least skill level entry to be productive in creating and managing resources.

The GUI approach does not provide any way to automate repetitive tasks. For example, to set up 15 or 150 VMs, you need to create them one by one by clicking through and completing the wizard each time; this can be time-consuming and error-prone, and allows for configuration drift.

The CLI approach allows repetitive tasks and scripting to be automated. Azure offers the flexibility to choose the CLI tool and the Shell environment that suits the user best for the task they need to do at that moment. Users have the choice of using a local shell on the device terminal they wish to execute CLI commands on or use the browser-based shell environment that Azure provides with Cloud Shell. Irrespective of the terminal environment they wish to use to run the commands, they can choose which CLI tool to use; they may choose to use a Bash experience through the Azure CLI for Linux users and PowerShell for Windows users.

Given that there is some parity regarding how these tools function, other factors must be considered when choosing a given task or scenario:

  • Automation: Do you need to repeat a set of repetitive or complex tasks? PowerShell and the Azure CLI support this, while the GUI portal does not.
  • Complexity and time: Automation shouldn’t be more complex than the task it is replacing; sometimes, a quick, non-complex manual portal or mobile app task/action is appropriate.
  • Learning curve and time: Do you need to complete a task quickly without learning new commands or syntax? PowerShell and the CLI require you to know the detailed syntax, and if you’re not using Cloud Shell, your local terminal device will require you to install the necessary components before you can start. Sometimes, a quick time to value, non-complex manual portal, or mobile app task/action is appropriate here.
  • Team skillset: Does the team have existing expertise? Do they come from a developer background where they write code and are more comfortable with a command-line and scripting interface (imperative tools), or do they come from an admin, engineering, or business analyst background and prefer a more visual, low-code/no-code (declarative tools) approach?

While outside of the exam objectives, you should consider that while Azure natively gives you access to tools that allow you to create, configure, and manage Azure resources, there are also third-party tools that should also be considered, and you should evaluate where their use may be appropriate. Some examples of some of the most common third-party tools that you will not be required to know about for the exam objectives, but will almost certainly come across, are Chef, Puppet, and Ansible; we looked at Terraform on Azure earlier in this chapter, which can be used as an integrated Azure tool.

The following diagram visualizes the Azure management tools approach:

Figure 6.14 – Azure management tools

In this section, we looked at the Azure GUI and CLI tools by conducting a thought exercise and looked at the different scenarios and considerations of when you may choose one management tool over another. In the next section, we will look at some hands-on exercises to help you build on the skills you learned about in this chapter.

Azure Dedicated Host, Microsoft Azure Exams

The Cloud Adoption Framework for Azure – Azure Governance

The Cloud Adoption Framework for Azure

The CAF is a collection of proven tools and documentation, including best practices, reference architectures, and implementation guidance. This allows business and technology strategies to be aligned so that they accelerate cloud adoption in a controlled and governed manner. The focus for this content is the cloud architect, who is the conduit for discussions and activity between the business and operations teams, and acts as the thought leader for the organization.

The CAF provides various methodologies, as per the following diagram:

Figure 9.6 – Azure CAF methodologies

Let’s look at these in more detail:

  • Strategy: Define justification and outcomes.
  • Plan: Align business outcomes to actionable adoption plans.
  • Ready: Preparation of the cloud environment.
  • Migrate: Existing workloads move and are modernized.
  • Innovate: New workload development using cloud-native or hybrid solutions.
  • Govern: Control of the environment.
  • Manage: Support and operations management.

The CAF documentation can be accessed via the following URL: https://docs.microsoft.com/azure/cloud-adoption-framework.

In this section, we looked at the CAF for Azure. The following section looks at the hands-on exercises for this chapter, which will help you build on the skills you’ve learned in this chapter.

Hands-on exercises

To support your learning with some practical skills, we will create some of the resources that were covered in this chapter.

The following exercises will be carried out:

  • Exercise 1 – assigning access with RBAC
  • Exercise 2 – creating a custom RBAC role
  • Exercise 3 – adding a resource lock to a resource group
  • Exercise 4 – enabling resource tagging with Azure Policy
  • Exercise 5 – limiting the resource creation location with Azure Policy

Getting started

To get started with these hands-on exercises, you will need an Azure subscription that has access to create and delete resources in the subscription; you can use an existing account that you have created as part of the exercises from any chapter in this book. Alternatively, you can create a free Azure account by going to https://azure.microsoft.com/free.

This free Azure account provides the following:

  • 12 months of free services
  • $200 credit to explore Azure for 30 days
  • 25+ services that are always free
Microsoft Azure Exams, Network and application protection

Exercise 1 – assigning access with RBAC – Azure Governance

Exercise 1 – assigning access with RBAC

This section will assign access to the resource group with RBAC using the Azure portal.

The following subsections cover how to complete this exercise, segregated into tasks for ease of understanding.

Task – accessing the Azure portal

  1. Log into the Azure portal at https://portal.azure.com. Alternatively, you can use the Azure desktop app: https://portal.azure.com/App/Download.

Task – creating a new resource group that requires access

  1. In the assigning with RBAC:resource group requiring access, creating” search bar, type resource groups; click Resource groups from the results list.
  2. From the Resource groups blade, click + Create via the top toolbar.
  3. From the Basics tab, set the Project and Resource details as required.
  4. Click Next: Review + create.
  5. On the Review + create tab, review your settings; you may go back to the previous tabs and make any edits if required. Once you have confirmed your settings are as required, you can click Create.
  6. You will receive a notification that the resource group was created successfully.
  7. Click Go to resource group from the Notifications blade. Alternatively, navigate to the resource group instance.

Task – assigning access to a resource group

  1. From the created Resource groups blade, click Access control (IAM) from the left-hand side menu.
  2. From the Roles tab, review the built-in roles; under the Details column, you can click on View to see the permissions that role will grant.
  3. From the Role assignments tab, review the current assignments.
  4. From the Check access tab, please review the options for My Access and Check access, and then click Add role assignment.
  5. From the Role tab, click Owner or the role you wish to assign.
  6. Click Next.
  7. For this exercise, leave Assign access to set to the default of User, Group, or Service Principal.
  8. From Members, select the members to be assigned the role.
  9. Click Next.
  10. Click Next: Review + assign.
  11. You will receive a notification that the role assignment was added.
  12. Click the Role assignments tab from the Access control (IAM) blade and review the new assignment that was created.

In this exercise, we successfully created a resource group and assigned the RBAC role to a user for access. In the following exercise, we will look at creating a custom RBAC role.

Microsoft Azure Exams, Other protection solutions

Exercise 2 – creating a custom RBAC role – Azure Governance

Exercise 2 – creating a custom RBAC role

This section will look at creating a custom RBAC role.

You can use an existing Azure AD instance to perform this exercise if you wish.

The following subsections cover how to complete this exercise, segregated into tasks for ease of understanding.

Task – accessing the Azure portal

  1. Log into the Azure portal at https://portal.azure.com. Alternatively, you can use the Azure desktop app: https://portal.azure.com/App/Download.

Task – creating a custom RBAC role

  1. In the search bar, type subscriptions; click Subscriptions from the results list.
  2. From the Subscriptions blade, click on your subscription.
  3. From the left menu of the Subscriptions blade, click Access Control (IAM).
  4. From the Access control blade, click +Add.
  5. Then, click Add custom role.
  6. From the Create a custom role blade, on the basics tab, enter the following information:
    • Custom role name.
    • Description.
    • Baseline permissions: leave as the default of Start from scratch.
  1. Click Next.
  2. From the Permissions tab, click +Add permissions.
  3. From the Add permissions blade, you can now search for each permission to add. You can now select the actions you wish the custom role to have. Then, click Add for each permission you wish to add.
  4. From the Permissions tab, click +Add permissions.
  5. Evaluate whether you need to add any exclude permissions; click Add or Cancel to return to the main blade to continue.
  6. Click Next: Review + create.
  7. On the Review + create tab, review your settings; you may go back to the previous tabs and make any edits if required. Once you have confirmed your settings, click Create.
  8. You will receive a message stating that the new custom RBAC role was created; click OK on the message.
  9. From the main Access control (IAM) blade, you will now be able to search/locate the new custom role that was created from the Roles tab.

In this exercise, we successfully created a custom RBAC role. In the following exercise, we will look at applying a resource lock to a resource group.

Microsoft Azure Exams, The Cloud Adoption Framework for Azure

Exercise 4 – enabling resource tagging with Azure Policy – Azure Governance

Exercise 4 – enabling resource tagging with Azure Policy

This section will look at enabling resource tagging with Azure Policy using the Azure portal.

The following subsections show how to complete this exercise, segregated into tasks for ease of understanding.

Task – accessing the Azure portal

  1. Log into the Azure portal at https://portal.azure.com. Alternatively, you can use the Azure desktop app: https://portal.azure.com/App/Download.

Task – creating a policy assignment

  1. In the search bar, type policy; click Policy from the results list.
  2. From the Policy blade, click Assignments under Authoring via the left navigation menu.
  3. Click Assign policy from the top toolbar.
  4. From the Policy definition field, under Basics on the Basics tab, click the ellipsis button on the right-hand side of the text box.
  5. From the Available Definitions page that appears, in the search box, enter require a tag.
  6. From the policy definition search results, click Require a tag on resource groups.
  7. Click Select.
  8. From the Parameters tab, in the Tag Name field, enter Environment as the text value.
  9. Click Next: Review + create.
  10. On the Review + create tab, review your settings; you may go back to the previous tabs and make any edits if required. Once you have confirmed your settings, click Create.
  11. You will receive a notification, stating that the policy assignment succeeded.

Task – testing the policy function

  1. In the search bar, type resource groups; click Resource groups from the results list.
  2. From the Resource groups blade, click the + Create button via the top toolbar.
  3. From the Basics tab, set the Project and Resource details as required.
  4. Click Next: Review + create.
  5. On the Review + create tab, click Create.
  6. You will receive a notification, stating that the resource group failed to be created; click View error details.
  7. In the summary tab, you will see that the policy disallowed the resource; this is the required expected behavior.
  8. From the Tags tab, enter the name that was defined in the policy; in our exercise, this text value was Environment.
  9. For this exercise, enter Production as the text value.
  10. Click Next: Review + create.
  11. On the Review + create tab, click Create.
  12. You will receive a notification, stating that the resource group was created successfully this time.
  13. Search for Tags or navigate to the Tags blade in the portal. You will see that your tag has been created. Upon clicking your tag, the page for the tag will show all the resources that have been tagged with it.
  14. The final task is to clean up and delete the assigned policy that was created in this exercise.
  15. From the Assignments blade, locate the assignment to delete from the list. Then, right-click and select Delete assignment from the pop-up menu.

In this exercise, we successfully created a policy to deny creating a resource that does not have a tag. In the following exercise, we will look at limiting the resource creation location with Azure Policy.

Azure Dedicated Host, Microsoft Azure Exams

Exercise 5 – limiting the resource creation location with Azure Policy – Azure Governance

Exercise 5 – limiting the resource creation location with Azure Policy

This section will look at limiting the resource creation location with Azure Policy using the Azure portal.

The following subsections cover how to complete this exercise, segregated into tasks for ease of understanding.

Task – accessing the Azure portal

  1. Log into the Azure portal at https://portal.azure.com. Alternatively, you can use the Azure desktop app: https://portal.azure.com/App/Download.

Task – removing the policy assignment from the previous exercise

  1. Before starting this exercise, if you created the policy assignment for the previous exercise and have not deleted this yet, do so now by performing the following step.
  2. From the Assignments blade, locate the assignment to delete from the list. Then, right-click and select Delete assignment from the pop-up menu.

Task – creating a policy assignment

  1. In the search bar, type policy; click Policy from the results list.
  2. From the Policy blade, click Assignments under Authoring on the left navigation menu.
  3. Click Assign policy from the top toolbar.
  4. From the Policy definition field, under Basics on the Basics tab, click the ellipsis button on the right-hand side of the text box.
  5. From the Available Definitions page that appears, in the search box, enter allowed locations.
  6. From the policy definition search results, click Allowed locations.
  7. Click Select.
  8. From the Parameters tab, select the allowed locations for resource creation.
  9. Click Next: Review + create.
  10. On the Review + create tab, review your settings; you may go back to the previous tabs and make any edits if required. Once you have confirmed your settings, click Create.
  11. You will receive a notification that the policy assignment succeeded.

Task – testing the policy function

  1. In the search bar, type virtual machines; click Virtual machines from the results list.
  2. From the Virtual machines blade, click the + Create button via the top toolbar and select Virtual machine.
  3. From the Basics tab, set the Project details as required.
  4. From the Instance details tab, select a region that is NOT on the allowed location for the policy; this is so we can test the limits of the region that was set in the policy.
  5. You will receive a notification about policy enforcement stating that in this example, the region selected does not match that allowed in the policy of a location that resources can be created in:

Policy enforcement. Value does not meet requirements on resource: Microsoft.Compute/virtualMachines

The field ‘Location’ with the value ‘(Europe) West Europe’ is denied

  1. To remediate this, from the Instance details tab, select a region that IS in the allowed location for the policy; this is so we can test the limits of the region that was set in the policy.
  2. You will no longer receive the policy enforcement message and will be allowed to continue with resource creation in the policy allowed location.
  3. The final task is to clean up and delete the assigned policy that was created in this exercise; this can be achieved by performing the following step.
  4. From the Assignments blade, locate the assignment to delete from the list. Then, right-click and select Delete assignment from the pop-up menu.

In this exercise, we successfully limited the resource creation location with Azure Policy.

This section covered the hands-on exercises for this chapter. The following section provides a summary of this chapter.

Azure DDoS protection, Azure Dedicated Host, Microsoft Azure Exams

Core security, privacy, and compliance tenets – Azure Privacy and Compliance

Core security, privacy, and compliance tenets

As we learned in Chapter 1, Introduction to Cloud Computing, security is a shared responsibility model. This means that certain responsibilities transfer to the cloud provider in a cloud environment operating model, while other responsibilities are retained by the customer; you should understand when it is your responsibility to provide the appropriate level of security and control, and when it is not your responsibility but instead that of the cloud services provider to ensure that their platform is kept compliant and your data is kept private.

The following security model diagram visually sets out the division or separation of responsibilities between the consumer of the cloud resources and the cloud services provider itself:

Figure 10.1 – Shared responsibility model

The most critical responsibilities to be aware of are the responsibilities that you, as the consumer of cloud services, always retain and your responsibility to secure and protect.

Security, compliance, privacy, and transparency are fundamental for a trust model and are the core tenets of Microsoft Online Services; the following diagram represents Microsoft’s trusted cloud principles:

Figure 10.2 – Microsoft trusted cloud principles

The preceding diagram shows that while it is your data and your control, Microsoft is responsible for delivering and operating a cloud services platform that will provide the data residency an organization needs, as well as ensuring it will keep that data secure, private, and compliant with recognized compliance and regulatory standards. These, however, are not just principles, but contractual guarantees.

In this section, we looked at Microsoft’s trusted cloud principles. The following sections look at how Microsoft delivers on these core tenets.

Trust Center

The Trust Center is a publicly accessible web portal that acts as a single point of focus for an organization that needs resources and in-depth information regarding the Microsoft principles of security, privacy, and compliance. The Trust Center can be accessed from https://www.microsoft.com/trust-center:

Figure 10.3 – Microsoft Trust Center

The Trust Center is a centralized place for any organization that needs information or resources on security, privacy, and compliance regarding Microsoft Online Services, not just Azure. The following section looks at the Microsoft Privacy Statement.

Azure DDoS protection, Microsoft Azure Exams, Network and application protection

Exercise 4 – creating resources using the Azure CLI from Cloud Shell – Azure Management Tools

Exercise 4 – creating resources using the Azure CLI from Cloud Shell

In this exercise, you’ll learn how to interact with Azure environments using the Azure CLI as the CLI tool and Cloud Shell as the shell environment for running commands.

The following subsections will show you how to create all the necessary resources for this exercise. These have been segregated into tasks for ease of understanding:

Task – accessing the Azure portal

  1. Log in to the Azure portal by going to https://portal.azure.com. Alternatively, you can use the Azure desktop app: https://portal.azure.com/App/Download.

Task – setting up Cloud Shell (skip this task if you’ve already completed it)

2. Click on the Cloud Shell code icon on the top toolbar of the portal. If this is the first time you have used Cloud Shell and no storage has been mounted to persist files, you will be prompted to create a storage account. Select your subscription and then click on Create storage:

Figure 6.31 – Cloud Shell setup

3. Once the storage account has been created, you will be connected to a terminal running the shell environment you will use to run commands.

Task – creating a resource group

  1. Bash should be set as the CLI within Cloud Shell for this exercise.
  2. To create a resource group, enter the following command:

az group create -l uksouth -n Project1-RG

6. The output will look as follows:

Figure 6.32 – Creating a resource group

  1. To show the resource group that has just been created, enter az group list or az group list –out table.
  2. The created resource group will also appear in the portal UI.

Figure 6.33 – Showing the created resource group

Task – creating a virtual machine

9. To create a virtual machine, enter the following code:

az vm create \

 –resource-group Project1-RG \

 –name myVM \

 –image win2019datacenter \

 –admin-username azureuser

10. When prompted, enter a username and password:

Figure 6.34 – Creating a virtual machine

  1. You will see a Running message while the virtual machine is being created.
  2. Once the virtual machine has been created, the following information will be returned:

Figure 6.35 – Virtual machine created

13. To show the virtual machine that has just been created, enter the following command:

az vm list –out table

14. The created virtual machine will also appear in the portal UI.

Figure 6.36 – Showing the created virtual machine

In this exercise, we created a resource group and a virtual machine using the Azure CLI from Cloud Shell. The following exercise looks at using Azure Service Health in the Azure portal.

Azure DDoS protection, Microsoft Azure Exams, Other protection solutions

Exercise 3 – creating resources using PowerShell from Cloud Shell – Azure Management Tools

Exercise 3 – creating resources using PowerShell from Cloud Shell

In this section, we’ll learn how to interact with Azure environments using PowerShell as the CLI tool and Cloud Shell as the shell environment for running commands.

The following subsections will show you how to create the necessary resources. These have been segregated into tasks for ease of understanding:

Task – accessing the Azure portal

  1. Log in to the Azure portal by going to https://portal.azure.com. Alternatively, you can use the Azure desktop app: https://portal.azure.com/App/Download.

Task – setting up Cloud Shell (skip this task if you’ve already completed it)

2. Click on the Cloud Shell code icon on the top toolbar of the portal; if this is the first time you have used Cloud Shell and no storage has been mounted to persist files, you will be prompted to create a storage account. Select your subscription and then click on Create storage:

Figure 6.24 – Cloud Shell setup

3. Once the storage account has been created, you will be connected to a terminal running the shell environment you will use to run commands.

Task – creating a resource group

  1. PowerShell should be set as the CLI within Cloud Shell for this exercise.
  2. In this exercise, we will use an example location; you may use a location that meets your needs. You can use the following command to find a location to use to create resources in:

Get-AzLocation

6. To create a resource group, enter the following command:

New-AzResourceGroup -Name Project1-RG -Location “UK South”

The output will look as follows:

Figure 6.25 – Creating a resource group

  1. To show the resource group that has just been created, enter Get-AzResourceGroup or Get-AzResourceGroup | Format-Table.
  2. The created resource group will also appear in the portal UI.

Figure 6.26 – Showing resource groups

Task – creating a virtual machine

9. To create a virtual machine, enter the following code:

New-AzVm `

 -ResourceGroupName “myResourceGroup” `

 -Name “MyVM” `

 -Location “UK South” `

 -VirtualNetworkName “myVnet”`

 -SubnetName “mySubnet” `

 -SecurityGroupName “myNetworkSecurityGroup” `

10. When prompted, enter a username and password.

Figure 6.27 – Creating a virtual machine

11. You will see a progress message while the virtual machine is being created.

Figure 6.28 – Virtual machine creation progress

12. Once the virtual machine has been created, you will see a ProvisioningState of Succeeded.

Figure 6.29 – Virtual machine created

13. To show the virtual machine that was just created, enter the following command:

get-AzVM

14. The created virtual machine will also appear in the portal UI.

Figure 6.30 – Showing the created virtual machine

In this exercise, we looked at creating a resource group and a virtual machine using PowerShell via Cloud Shell. In the following exercise, we will create a resource group and a virtual machine using the Azure CLI from Cloud Shell.

Azure DDoS protection, Microsoft Azure Exams, The Cloud Adoption Framework for Azure

Exercise 1 – installing Azure PowerShell – Azure Management Tools

Exercise 1 – installing Azure PowerShell

In this section, you’ll learn how to install the Azure PowerShell module.

The following steps must be carried out on the OS of a machine you have admin access to; this could be physical or virtual. We are using a Windows 10 device for this exercise – Windows 10 Pro 20H2 using PowerShell 7 for reference:

  1. On your device, search for Windows PowerShell 7 and click Open.

Figure 6.15 – Searching for PowerShell

2. Check the version of PowerShell by running the following command from within PowerShell:

$PSVersionTable.PSVersion

The output will look as follows:

Figure 6.16 – PowerShell version

3. Enter the following command; the PowerShell script execution policy must be set to remote signed or less restrictive:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Confirm this using the following command:

Get-ExecutionPolicy -List

The output will be as follows:

Figure 6.17 – Setting the execution policy

4. Enter the following command to install the Az module:

Install-Module -Name Az -AllowClobber -Scope CurrentUser -Repository PSGallery -Force

The following screenshot shows the installation progress:

Figure 6.18 – PowerShell version

You will see the following when the Az module is imported if the version of PowerShell you’re using is not supported:

“This version of Az.Accounts is only supported on Windows PowerShell 5.1 and PowerShell 7.0.6 or greater, open https://aka.ms/install-powershell to learn how to upgrade. For further information, go to https://aka.ms/azpslifecyle.”

Enter the following command to check the version of the PowerShell module that’s been installed:

Get-InstalledModule -Name Az

The output will look as follows:

Figure 6.19 – PowerShell module version

5. Enter the following to update all the Powershell modules to their latest versions:

Update-Module

6. The following command will update the Azure PowerShell module:

Update-Module -Name Az

In this exercise, we looked at installing the Azure Powershell module. We will install the Azure CLI in the following exercise.

Recent Comments

No comments to show.
Back To Top