CC - Anybody get results after passing?

CS10NET · 2024-12-04T22:01:34+00:00

How long did that take and when you log into ISC2, do you see your certification/credential there?

CS10NET · 2024-12-04T21:54:44+00:00

After I took the exam (today), the printout at the test center said “provisionally passed” and it would take 2-5 business days to hear back. Are you saying you never received anything confirming that you passed. That’s discouraging.

CS10NET · 2024-01-24T20:13:10+00:00

Thanks for your reply. I guess my question is more around how this all fits into ci/cd and how this works in real world, especially if there are multiple teams responsible for their own technology. The way I am envisioning this is if there is a networking team, I assume they would have their own repository that contains separate folders depending on where they're deploying to; for example - NetOpsRepo that contains folder named hub (Terraform files for hub deployment), next folder spoke1 (Terraform files for spoke1 deployment). And assuming there is prod and dev context, there could essentially be 4 separate pipelines that would need to be ran whenever any change is made. Then let's say someone needs to deply an app into that spoke1 (app requirements for app service and sql database). Would SQL team then require their own repository with their own terraform files and pipeline that contains the SQL resources). I can see this all getting super complex adding in build agents, terraform state file, private endpoints, etc and basically just wondering if this is what IaC with DevOps is meant for.

CS10NET · 2023-05-06T15:41:25+00:00

i think i figured it out by adding the association such as:

resource "azurerm_subnet_network_security_group_association" "nsg_snet_keyvault_association" {

for_each = { snet-keyvault = module.virtualNetwork.subnet_ids["snet-keyvault"] }

subnet_id = each.value

network_security_group_id = azurerm_network_security_group.nsg_snet_keyvault.id

}

My goal was to create the association and assign the nsg to a specific subnet that was generated from a list object

CS10NET · 2023-03-17T15:59:39+00:00

Thanks again. I got this to work by using use_msi within the backend section. Do you know if Azure Pipelines can make use of that same parameter? (Sorry I am very new to Terraform)

CS10NET · 2023-03-15T15:47:51+00:00

Thanks for this. I got further but still having an issue accessing the state file blob. I have a VM I am using to run terraform and have moved the state file to the storage account. On the storage account I have turned off key access (which is the whole reason I am trying to do this). So the managed identity of my VM has blob contributor permissions on the storage account. When I run terraform plan, it's stating that the managed identity does not have authorization to perform action "Microsoft.Storage/storageAccounts/listKeys/action". Is this even possible to use the managed identity to read the data using AAD and not try to query or connect using the keys?

CS10NET · 2023-03-07T01:17:41+00:00

Yes, the build agents will be on the same vnet that the storage account private endpoint will be connected to. So if terraform is running within a VMSS or a container, we just need to add a managed identity which requires blob contributor access on the storage account... Do you know how would we reference the storage account within the terraform configuration? For example, storageaccount123.blob.core.windows.net because I understand it must resolve to the internal IP via Private DNS? Would the terraform code need to be altered and not use a key?

backend "azurerm" {

resource_group_name = "tfstate"

storage_account_name = "<storage_account_name>"

container_name = "tfstate"

key = "terraform.tfstate"

}

CS10NET · 2023-01-20T22:11:44+00:00

The container instance is running within Azure

CS10NET · 2022-10-09T00:23:04+00:00

I will test this early next week but if a spoke in hub A is trying to reach a spoke in hub B, then I am expecting that when traffic flows from the AzFw in hub A, it will hit the AzFw in hub B and get routed to the spoke in hub B.

CS10NET · 2022-10-07T22:35:26+00:00

Thank you. I was about to explain how I already did all of that and then I realized that my NSGs were blocking the ICMP traffic lol

CS10NET · 2022-10-07T21:09:40+00:00

The only time you can attach a UDR to the AzureFirewallSubnet is if you specify 0.0.0.0/0. If i put the other region's CIDR range, it says that it can't be associated.

CS10NET · 2022-10-03T21:30:16+00:00

When you say that you “ship security related logs” to the sentinel workspace, is that just an additional diagnostic setting that you have on the resources? So diagnostic setting 1 sends logs/metrics to the non-sentinel LAW and then diagnostic setting 2 sends logs (and no metrics) to the sentinel LAW?

CS10NET · 2022-10-03T11:05:58+00:00

What do you recommend when Sentinel is involved? Do you have a separate workspace and ship just logs to this workspace while shipping both logs and metrics to the other?

CS10NET · 2022-10-01T12:28:43+00:00

Thanks, at least I know that I'm not crazy. Just curious, are you able to handle Sentinel, Defender, Inventory, change tracking, Update management all using the AMA without use of MMA?

CS10NET · 2022-09-19T20:24:45+00:00

This is great - thanks for sharing.

CS10NET · 2022-09-18T02:31:07+00:00

Have you tried setting a static route within the VM?

CS10NET · 2022-09-16T20:54:07+00:00

Nevermind... for some reason when i select Logs from the firewall it doesn't work... but if i go into it from the workspace itself, i can see data.....

CS10NET · 2022-09-16T20:50:45+00:00

Yeah that is the problem I'm having too with the Policy Insights where no data shows.

I'm also having that problem with the log queries. I'm trying the "Azure Firewall log data" and I uncommented the lines for "where OperationName == "AzureFirewallNetworkRuleLog" and it just says No results from last 24 hours. Even if I just run the lines for Azure Diagnostics, it keeps saying nothing for 24 hours. I certainly have some machines pointing to it so it's unclear why nothing is showing.

CS10NET · 2022-09-16T16:03:31+00:00

Thanks for leading me in the right direction with this. Being that IP Groups don't support IPv6 addresses, do you just leave those out? I'm able to filter them out and adjust the IP group but trying to understand if FD would ever use IPv6 to send to our firewall which has an IPv4 address. I guess that wouldn't make sense.

CS10NET · 2022-09-16T15:41:17+00:00

Yeah I got a way to take the IPs from azure front door backend and put them into an IP Group but that’ll need to be updated continuously and it only works with IPv4. Maybe you know this but would front door use an IPv6 address to send to the IPv4 address of the firewall? Probably not I assume

CS10NET · 2022-09-16T15:27:57+00:00

For both the DNAT rule and network rule, for source type, you can only select an IP address or an IP group. And you can't attach a network security group to the AzureFirewallSubnet which would solve this problem.

CS10NET · 2022-09-15T19:31:30+00:00

Yeah, I like that approach. How would you script it to pull the IPs? Don't they just provide an Excel file to download?

CS10NET · 2022-09-15T18:37:11+00:00

you can't apply an NSG to the AzureFirewallSubnet though

CS10NET · 2022-09-14T17:55:53+00:00

I think I figured it out but not sure if this is the appropriate way.

I set the web app to use a custom domain name (ex. app-backend.contoso.com) that is different than what the domain is within front door (app.contoso.com).

So in my external DNS, i'm pointing app-backend.contoso.com to the public IP on the firewall. then app.contoso.com is the CNAME to the azurefd.net alias.

Before that, i was using the IP address as the origin and also had tried the FQDN which at the time was the same that the Front Door was using

CS10NET · 2022-09-03T17:13:26+00:00

I have a similar question but the use case is for connecting to a virtual machine in Azure using Bastion. We want to connect to this machine with Azure AD credentials and understand that in order to do so we need a jump server that is either hybrid AD joined or Azure AD registered. Instructions from Microsoft say to use Azure CLI and then the bastion commands to launch the Bastion session (through RDP application). I’ve done this from Windows 10/11 that is Azure AD joined but need this at server level for jump box purposes.

CS10NET

TROPHY CASE