Merge pull request #47853 from wwlpublish/e9e5b729bc804a82ecb03327c78b190d3d76b94b86974e236f09737e685bef70-live

JamesJBarnett · web-flow · commit 195e0e46b89d · 2024-11-08T14:13:05.000-07:00
Modules/M07-guided-project-configure-secure-access-workloads
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/1-introduction.yml b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/1-introduction.yml
@@ -2,14 +2,14 @@
 uid: learn.wwl.guided-project-configure-secure-access-workloads.introduction
 title: Introduction
 metadata:
-  adobe-target: true
-  prefetch-feature-rollout: true
   title: Introduction
   description: "Introduction"
-  ms.date: 03/08/2024
+  ms.date: 11/08/2024
   author: wwlpublish
   ms.author: jileary
   ms.topic: unit
+  ms.custom:
+  - N/A
 durationInMinutes: 3
 content: |
-  [!include[](includes/1-introduction.md)]
+  [!include[](includes/1-introduction.md)]
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/2-exercise-vnet.yml b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/2-exercise-vnet.yml
@@ -1,15 +1,15 @@
 ### YamlMime:ModuleUnit
 uid: learn.wwl.guided-project-configure-secure-access-workloads.exercise1
-title: Exercise - Provide network isolation and segmentation for the web application
+title: Exercise 01 - Create and configure virtual networks
 metadata:
-  adobe-target: true
-  prefetch-feature-rollout: true
-  title: Exercise - Provide network isolation and segmentation for the web application
-  description: "Exercise - Provide network isolation and segmentation for the web application"
-  ms.date: 03/08/2024
+  title: Exercise 01 - Create and configure virtual networks
+  description: "Create and configure virtual networks"
+  ms.date: 11/08/2024
   author: wwlpublish
   ms.author: jileary
   ms.topic: unit
+  ms.custom:
+  - N/A
 durationInMinutes: 10
 content: |
-  [!include[](includes/2-exercise-vnet.md)]
+  [!include[](includes/2-exercise-vnet.md)]
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/3-exercise-security-groups.yml b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/3-exercise-security-groups.yml
@@ -1,15 +1,15 @@
 ### YamlMime:ModuleUnit
 uid: learn.wwl.guided-project-configure-secure-access-workloads.exercise2
-title: Exercise - Control the network traffic to and from the web application
+title: Exercise 02 - Create and configure network security groups
 metadata:
-  adobe-target: true
-  prefetch-feature-rollout: true
-  title: Exercise - Control the network traffic to and from the web application
-  description: "Exercise - Control the network traffic to and from the web application"
-  ms.date: 03/08/2024
+  title: Exercise 02 - Create and configure network security groups
+  description: "Create and configure network security groups"
+  ms.date: 11/08/2024
   author: wwlpublish
   ms.author: jileary
   ms.topic: unit
+  ms.custom:
+  - N/A
 durationInMinutes: 15
 content: |
-  [!include[](includes/3-exercise-security-groups.md)]
+  [!include[](includes/3-exercise-security-groups.md)]
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/4-exercise-firewall.yml b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/4-exercise-firewall.yml
@@ -1,15 +1,15 @@
 ### YamlMime:ModuleUnit
 uid: learn.wwl.guided-project-configure-secure-access-workloads.exercise3
-title: Exercise - Protect the web application from malicious traffic and block unauthorized access
+title: Exercise 03 - Create and configure Azure Firewall
 metadata:
-  adobe-target: true
-  prefetch-feature-rollout: true
-  title: Exercise - Protect the web application from malicious traffic and block unauthorized access
-  description: "Exercise - Protect the web application from malicious traffic and block unauthorized access"
-  ms.date: 03/08/2024
+  title: Exercise 03 - Create and configure Azure Firewall
+  description: "Create and configure Azure Firewall"
+  ms.date: 11/08/2024
   author: wwlpublish
   ms.author: jileary
   ms.topic: unit
+  ms.custom:
+  - N/A
 durationInMinutes: 30
 content: |
-  [!include[](includes/4-exercise-firewall.md)]
+  [!include[](includes/4-exercise-firewall.md)]
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/5-exercise-policy.yml b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/5-exercise-policy.yml
@@ -1,15 +1,15 @@
 ### YamlMime:ModuleUnit
 uid: learn.wwl.guided-project-configure-secure-access-workloads.exercise4
-title: Exercise - Operationalize and enforce policy to filter traffic
+title: Exercise 04 - Configure network routing
 metadata:
-  adobe-target: true
-  prefetch-feature-rollout: true
-  title: Exercise - Operationalize and enforce policy to filter traffic
-  description: "Exercise - Operationalize and enforce policy to filter traffic"
-  ms.date: 03/08/2024
+  title: Exercise 04 - Configure network routing
+  description: "Configure network routing"
+  ms.date: 11/08/2024
   author: wwlpublish
   ms.author: jileary
   ms.topic: unit
+  ms.custom:
+  - N/A
 durationInMinutes: 15
 content: |
-  [!include[](includes/5-exercise-policy.md)]
+  [!include[](includes/5-exercise-policy.md)]
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/6-exercise-domain-names.yml b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/6-exercise-domain-names.yml
@@ -1,15 +1,15 @@
 ### YamlMime:ModuleUnit
 uid: learn.wwl.guided-project-configure-secure-access-workloads.exercise5
-title: Exercise - Record and resolve domain names internally
+title: 'Exercise 05 - DNS zones '
 metadata:
-  adobe-target: true
-  prefetch-feature-rollout: true
-  title: Exercise - Record and resolve domain names internally
-  description: "Exercise - Record and resolve domain names internally"
-  ms.date: 03/08/2024
+  title: Exercise 05 - DNS zones
+  description: "DNS zones"
+  ms.date: 11/08/2024
   author: wwlpublish
   ms.author: jileary
   ms.topic: unit
+  ms.custom:
+  - N/A
 durationInMinutes: 15
 content: |
-  [!include[](includes/6-exercise-domain-names.md)]
+  [!include[](includes/6-exercise-domain-names.md)]
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/7-knowledge-check.yml b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/7-knowledge-check.yml
@@ -2,14 +2,14 @@
 uid: learn.wwl.guided-project-configure-secure-access-workloads.knowledge-check
 title: Knowledge check
 metadata:
-  adobe-target: true
-  prefetch-feature-rollout: true
   title: Knowledge check
   description: "Knowledge check"
-  ms.date: 03/08/2024
+  ms.date: 11/08/2024
   author: wwlpublish
   ms.author: jileary
   ms.topic: unit
+  ms.custom:
+  - N/A
 durationInMinutes: 8
 content: |
   [!include[](includes/7-knowledge-check.md)]
@@ -34,7 +34,7 @@ quiz:
       explanation: "Incorrect. Rules are processed according to the specified priority."
     - content: "The deny rule takes precedence."
       isCorrect: true
-      explanation: "Correct. The deny rule takes precedence because it's processed first. The rule with priority 150 is processed before the rule with priority 200."
+      explanation: "Correct. The deny rule takes precedence. The rule with priority 150 is processed before the rule with priority 200."
     - content: "The rule that was created first takes precedence."
       isCorrect: false
       explanation: "Incorrect. Rules are processed according to the specified priority."
@@ -59,4 +59,4 @@ quiz:
       explanation: "Incorrect. A NAT rule can be used to translate and filter inbound internet traffic based on your firewall's public IP address and a specified port number."
     - content: "Application rule"
       isCorrect: true
-      explanation: "Correct. You can use an application rule to filter traffic based on an FQDN address such as server1.database.windows.net."
+      explanation: "Correct. You can use an application rule to filter traffic based on an FQDN address such as server1.database.windows.net."
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/8-summary.yml b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/8-summary.yml
@@ -2,14 +2,14 @@
 uid: learn.wwl.guided-project-configure-secure-access-workloads.summary
 title: Summary and resources
 metadata:
-  adobe-target: true
-  prefetch-feature-rollout: true
   title: Summary and resources
   description: "Summary"
-  ms.date: 03/08/2024
+  ms.date: 11/08/2024
   author: wwlpublish
   ms.author: jileary
   ms.topic: unit
+  ms.custom:
+  - N/A
 durationInMinutes: 3
 content: |
-  [!include[](includes/8-summary.md)]
+  [!include[](includes/8-summary.md)]
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/includes/2-exercise-vnet.md b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/includes/2-exercise-vnet.md
@@ -1,19 +1,27 @@
 ## Scenario 
 
-The IT department needs network isolation and segmentation for the web application. Once the virtual network is created, the next step would be to configure virtual network peering. This peering allows the virtual networks to communicate with each other securely and privately.
+Your organization is migrating a web-based application to Azure. Your first task is to put in place the virtual networks and subnets. You also need to securely peer the virtual networks. You identify these requirements.
 
-To provide network isolation and segmentation for the web application, you create an Azure virtual network and configure subnets and virtual network peering. 
++ Two virtual networks are required, **app-vnet** and **hub-vnet**. 
++ The app-vnet hosts the application. This virtual network requires two subnets. The **frontend** subnet hosts the web servers. The **backend** subnet hosts the database servers.
++ The hub-vnet only requires a subnet for the firewall. 
++ The two virtual networks must be able to communicate with each other securely and privately through virtual network peering. 
++ Both virtual networks should be in the same region. 
 
-### Architecture diagram
+## Skilling Tasks
 
-| Network solution  | Tasks|
-| --- | --- |
-| :::image type="content" source="../media/task-1.png" alt-text="Diagram that shows two virtual networks that are peered." border="true"::: | <ul><li>Create a virtual network. </li><li> Create a subnet. </li><li>Configure virtual network peering. </li></ul> |
++ Create a virtual network. 
++ Create a subnet. 
++ Configure virtual network peering. 
+ 
+## Architecture diagram
+
+:::image type="content" source="../media/task-1.png" alt-text="Diagram that shows two virtual networks that are peered." border="true"::: 
 
 Launch the exercise and follow the instructions. When you're done, be sure to return to this page so you can continue learning.
 
 > [!NOTE]
-> To complete this lab you will need an [Azure subscription](https://azure.microsoft.com/free/).
+> To complete this lab you need an [Azure subscription](https://azure.microsoft.com/free/).
 
 [![Button to launch exercise.](../media/launch-exercise.png)](https://go.microsoft.com/fwlink/?linkid=2261590)
 
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/includes/3-exercise-security-groups.md b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/includes/3-exercise-security-groups.md
@@ -1,17 +1,28 @@
 ## Scenario
 
-Your organization requires control of the network traffic to and from the web application. To further enhance the security of the web application, network security groups (NSG) and application security groups (ASG) can be configured. NSG is a security layer that filters network traffic to and from Azure resources, while ASG allows grouping of resources to be managed collectively. These security groups provide fine-grained control over the network traffic to and from the web application components.
+Your organization requires the network traffic in the app-vnet to be tightly controlled. You identify these requirements.
++ The frontend subnet has web servers that can be accessed from the internet. An application security group (ASG) is required for those servers. The ASG should be associated with any virtual machine interface that is part of the group. 
++ An NSG rule is required to allow inbound HTTPS traffic to the ASG. This rule uses the TCP protocol on port 443. 
++ The backend subnet has database servers used by the frontend web servers. A network security group (NSG) is required to control this traffic. The NSG should be associated with any virtual machine interface accessed by the web servers. 
++ An NSG rule is required to allow inbound network traffic from the ASG to the backend servers. This rule uses the MS SQL service and port 1443. 
++ A virtual machine should be installed in the frontend subnet (VM1) and the backend subnet (VM2). The IT group has an Azure Resource Manager template to deploy these Ubuntu servers. 
 
-### Architecture diagram
+## Skilling Tasks
 
-| Network solution  | Tasks|
-| --- | --- |
-| :::image type="content" source="../media/task-2.png" alt-text="Diagram that shows one ASG and NSG associated to a virtual network." border="true"::: | <ul><li>Create an NSG. </li><li> Create NSG rules. </li><li> Associate an NSG to a subnet. </li><li> Create and use Application Security Groups in NSG rules. </li></ul> |
++ Create an NSG. 
++ Create NSG rules. 
++ Associate an NSG to a subnet. 
++ Create and use Application Security Groups in NSG rules. 
+
+
+## Architecture diagram
+
+:::image type="content" source="../media/task-2.png" alt-text="Diagram that shows one ASG and NSG associated to a virtual network." border="true":::
 
 
 Launch the exercise and follow the instructions. When you're done, be sure to return to this page so you can continue learning.
 
 > [!NOTE]
-> To complete this lab you will need an [Azure subscription](https://azure.microsoft.com/free/).
+> To complete this lab you need an [Azure subscription](https://azure.microsoft.com/free/).
 
 [![Button to launch exercise.](../media/launch-exercise.png)](https://go.microsoft.com/fwlink/?linkid=2261960)
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/includes/4-exercise-firewall.md b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/includes/4-exercise-firewall.md
@@ -1,21 +1,27 @@
 ## Scenario
 
-Your organization is looking to protect the web application from malicious traffic and block unauthorized access.
+Your organization requires centralized network security for the application virtual network. As the application usage increases, more granular application-level filtering and advanced threat protection are needed. Also, the application needs continuous updates from Azure Pipelines. You identify these requirements.
++ Azure Firewall is required for security in the app-vnet. 
++ A firewall policy should be configured to help manage access to the application. 
++ A firewall policy **application rule** is required. This rule allows the application access to Azure DevOps so the application code can be updated. 
++ A firewall policy **network rule** is required. This rule allows DNS resolution. 
 
-In addition to NSG and ASG, a firewall can be configured to add an extra layer of security to the web application. A firewall protects the web application from malicious traffic and blocks unauthorized access with policies you configure. 
+## Skilling Tasks
 
-Azure Firewall policy is a top-level resource that contains security and operational settings for Azure Firewall. It allows you to define a rule hierarchy and enforce compliance. In this task you configure application rules and network rules for the firewall using Firewall Policy. You can use Azure Firewall Policy to manage rule sets that the Azure Firewall uses to filter traffic.
++ Create an Azure Firewall.
++ Create and configure a firewall policy.
++ Create an application rule collection.
++ Create a network rule collection.
 
-### Architecture Diagram
 
-| Network solution | Tasks|
-| --- | --- |
-| :::image type="content" source="../media/task-3.png" alt-text="Diagram that shows one virtual network with a firewall and route table." border="true"::: | <ul><li>Create an Azure Firewall.</li><li>Create and configure a firewall policy.</li><li>Create an application rule collection.</li><li>Create a network rule collection.</li></ul>|
+## Architecture Diagram
+
+:::image type="content" source="../media/task-3.png" alt-text="Diagram that shows one virtual network with a firewall and route table." border="true":::
 
 Launch the exercise and follow the instructions. When you're done, be sure to return to this page so you can continue learning.
 
 > [!NOTE]
-> To complete this lab you will need an [Azure subscription](https://azure.microsoft.com/free/).
+> To complete this lab you need an [Azure subscription](https://azure.microsoft.com/free/).
 
 [![Button to launch exercise.](../media/launch-exercise.png)](https://go.microsoft.com/fwlink/?linkid=2261961)
 
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/includes/5-exercise-policy.md b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/includes/5-exercise-policy.md
@@ -1,16 +1,22 @@
 ## Scenario
 
-Now that a firewall is in place with policies that enforce your organizations security requirements, you need to route your network traffic to the firewall subnet so it can filter and inspect the traffic. Route tables provide control over the routing of network traffic to and from the web application. Network Traffic is subject to the firewall rules when you route your network traffic to the firewall as the subnet default gateway.
+To ensure the firewall policies are enforced, outbound application traffic must be routed through the firewall. You identify these requirements. 
++ A route table is required. This route table is associated with the frontend and backend subnets.  
++ A route is required to filter all outbound IP traffic from the subnets to the firewall.  
 
-### Architecture diagram
+## Skilling Tasks
 
-| Network solution | Tasks|
-| --- | --- |
-| :::image type="content" source="../media/task-4.png" alt-text="Diagram that shows a firewall policy." border="true"::: | <ul><li> Create and configure a route table.</li><li> Link a route table to a subnet.</li></ul> |
++ Create and configure a route table.
++ Link a route table to a subnet.
+
+
+## Architecture diagram
+
+:::image type="content" source="../media/task-4.png" alt-text="Diagram that shows a firewall policy." border="true"::: 
 
 Launch the exercise and follow the instructions. When you're done, be sure to return to this page so you can continue learning.
 
 > [!NOTE]
-> To complete this lab you will need an [Azure subscription](https://azure.microsoft.com/free/).
+> To complete this lab you need an [Azure subscription](https://azure.microsoft.com/free/).
 
 [![Button to launch exercise.](../media/launch-exercise.png)](https://go.microsoft.com/fwlink/?linkid=2261688)
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/includes/6-exercise-domain-names.md b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/includes/6-exercise-domain-names.md
@@ -1,16 +1,23 @@
 ## Scenario
 
-Your organization requires workloads to record and resolve domain names internally in virtual networks. Virtual machines in virtual networks can use domain name instead of IPs for internal communication. In that case, the domain names will be resolved with a private DNS zone through a virtual network link. 
+Your organization requires workloads to use domain names instead of IP addresses for internal communications. The organization doesn’t want to add a custom Domain Name Service (DNS) solution. You identify these requirements.
++ A private DNS zone is required for `private.contoso.com`.
++ The DNS uses a virtual network link to app-vnet. 
++ A new DNS record is required for the backend subnet. 
 
-### Architecture diagram
+## Skilling Tasks
 
-|Network solution | Tasks|
-| --- | --- |
-| :::image type="content" source="../media/task-5.png" alt-text="Diagram of Azure DNS linked to a virtual network." border="true"::: | <ul><li>Create and configure a private DNS zone. </li><li> Create and configure DNS records. </li><li>  Configure DNS settings on a virtual network.</li></ul> |
++ Create and configure a private DNS zone. 
++ Create and configure DNS records. 
++ Configure DNS settings on a virtual network.
+
+## Architecture diagram
+
+:::image type="content" source="../media/task-5.png" alt-text="Diagram of Azure DNS linked to a virtual network." border="true"::: 
 
 Launch the exercise and follow the instructions. When you're done, be sure to return to this page so you can continue learning.
 
 > [!NOTE]
-> To complete this lab you will need an [Azure subscription](https://azure.microsoft.com/free/).
+> To complete this lab you need an [Azure subscription](https://azure.microsoft.com/free/).
 
 [![Button to launch exercise.](../media/launch-exercise.png)](https://go.microsoft.com/fwlink/?linkid=2262041)
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/includes/7-knowledge-check.md b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/includes/7-knowledge-check.md
@@ -1,3 +1,6 @@
+
+
+
 ### Answer the following questions
 
-Choose the best response for each of the following questions. 
+Choose the best response for each of the following questions.
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/index.yml b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/index.yml
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/media/task-1.png b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/media/task-1.png
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/media/task-2.png b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/media/task-2.png
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/media/task-3.png b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/media/task-3.png
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/media/task-4.png b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/media/task-4.png
diff --git a/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/media/task-5.png b/learn-pr/wwl-azure/guided-project-configure-secure-access-workloads/media/task-5.png
