5. A cybersecurity analyst reviews infrastructure as code (IaC) scans of a new application to ensure the infrastructure requires authentication for incoming requests. After running the IaC configuration scanner, the analyst sees the following output:LOW: Ensure that Managed Identity provider is enabled for app services - Checkov (CKV_AZURE_71), MEDIUM: Ensure the web app has 'Client certificates (Incoming Client Certificates)' set - Checkov (CKV_AZURE_17), MEDIUM: Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service - Checkov (CKV_AZURE_14), MEDIUM: Ensure that FTP register with Azure Active Directory is enabled on App Service - Checkov (CKV_AZURE_16), MEDIUM: Ensure that FTP deployments are disabled - Checkov (CKV_AZURE_78), LOW: Ensure that verbose logging is enabled for the web app - Checkov (CKV_AZURE_61), MEDIUM: Ensure that 'HTTP Version' is the latest if used to run the web app - Checkov (CKV_AZURE_18).Which of the following alerts should the analyst address to meet the requirement? (Select two).
Answer: B,C
To meet the requirement, the analyst should address CKV_AZURE_16 and CKV_AZURE_17.
Both CKV_AZURE_16 and CKV_AZURE_17 are marked as medium alerts and are critical for ensuring the security of the application. CKV_AZURE_16 involves enabling FTP registration with Azure Active Directory, while CKV_AZURE_17 pertains to the requirement for client certificates for incoming requests, both of which are essential for authentication.
A) CKV_AZURE_14
CKV_AZURE_14 relates to ensuring web app redirects all HTTP traffic to HTTPS, which, while important for securing data in transit, does not directly address the requirement for authentication of incoming requests. Therefore, it is not one of the alerts the analyst should prioritize.
B) CKV_AZURE_16
CKV_AZURE_16 is a medium alert that ensures FTP registration with Azure Active Directory is enabled. This is relevant as it pertains to authentication mechanisms, making it a critical alert for the analyst to address in order to fulfill the requirement of securing incoming requests.
C) CKV_AZURE_17
CKV_AZURE_17 requires that the web app has 'Client certificates (Incoming Client Certificates)' set. This is crucial for authenticating incoming requests, thus making it essential for the analyst to address this alert alongside CKV_AZURE_16 to meet the authentication requirement.
D) CKV_AZURE_18
CKV_AZURE_18 focuses on ensuring that the HTTP version used to run the web app is the latest. While keeping the HTTP version updated is important for performance and security, it does not directly relate to the authentication of incoming requests, making it less relevant in this context.
E) CKV_AZURE_71
CKV_AZURE_71 is a low alert that suggests ensuring that the Managed Identity provider is enabled for app services. While it has its significance, it does not specifically address the authentication requirement for incoming requests, hence it should not be prioritized.
F) CKV_AZURE_78
CKV_AZURE_78 indicates the need to ensure that FTP deployments are disabled. Although disabling FTP deployments is a good security practice, it does not directly pertain to the requirement of ensuring authentication for incoming requests, and therefore is not critical for the analyst to address in this scenario.
Conclusion
The alerts CKV_AZURE_16 and CKV_AZURE_17 are directly aligned with the requirement for ensuring authentication for incoming requests, making them essential for the analyst to address. In contrast, the other options either focus on different aspects of security or do not directly contribute to the authentication goal, rendering them less relevant in this specific context.