Knowledge check

1.

Contoso's point-to-site VPN currently uses shared certificate authentication. After a certificate is compromised, any device with the certificate can connect. What authentication change reduces this risk most effectively?

Increase the certificate key length from 2048-bit to 4096-bit and reissue certificates to all users.

Switch P2S authentication to Microsoft Entra ID so that each connection requires valid Microsoft Entra credentials and supports Conditional Access and MFA.

Deploy a RADIUS server on-premises and configure the VPN gateway to use RADIUS for certificate validation.

2.

Contoso has 3,000 remote employees connected via VPN. A security audit finds that all employees with VPN access can reach every Azure-hosted application regardless of their role. What is the most effective control to address the over-broad access problem without disrupting all VPN connectivity?

Add Network Security Group (NSG) rules on each application subnet to restrict access by employee IP address ranges assigned by the VPN.

Deploy Microsoft Entra Private Access and configure per-app access segments so that users only reach the specific applications their role requires, enforced by Conditional Access policy.

Implement split tunneling on the VPN so that only Azure-bound traffic goes through the VPN and internet traffic routes locally.

3.

Contoso's site-to-site VPN connection uses IKEv1 with default encryption settings. The security team wants to enforce stronger encryption. Which configuration change achieves this?

Upgrade the VPN gateway SKU to VpnGw5 for higher throughput and stronger default encryption.

Create a custom IPsec/IKE policy on the connection that specifies IKEv2, AES-256 encryption, SHA-256 integrity, and a DHGroup with at least 2048-bit key strength.

Enable forced tunneling on the site-to-site connection to route all branch traffic through Azure before reaching the internet.

Check your knowledge

Feedback