An architect is mapping Azure perimeter controls and must match each protective need to the correct service. Which TWO pairings of an Azure security service with the threat it is designed to address are correct? Select TWO.
- AAzure Bastion defends storage accounts against malware uploaded by users to file shares.
- BAzure DDoS Protection defends public endpoints against volumetric traffic floods that exhaust resources. Correct
- CNetwork security groups defend applications by detonating email attachments in a sandbox.
- DWeb application firewall defends web apps against common exploits such as SQL injection and cross-site scripting. Correct
- EAzure Key Vault defends virtual machines by recording administrative RDP and SSH sessions.
Why A is wrong: Bastion brokers RDP and SSH to VMs; storage malware scanning is a Defender for Storage capability, not Bastion.
Why B is correct: DDoS Protection is purpose-built to detect and mitigate volumetric, protocol, and resource-exhaustion flood attacks.
Why C is wrong: Attachment detonation is Defender for Office 365 Safe Attachments; NSGs only filter network traffic flows.
Why D is correct: A WAF inspects HTTP traffic and blocks OWASP-class web exploits like injection and scripting attacks.
Why E is wrong: Session recording is an Azure Bastion premium feature; Key Vault stores secrets, keys and certificates only.