A county Azure landing zone needs continuous attack simulation against publicly exposed application gateways only. What targeting practice should guide that cloud emulation?
Select an answer to reveal the explanation.
Short Explanation
Keep the laser on the public doors you've authorized — application gateways — you're not scoped to hit VPN gateways. Continuous cloud emulation still needs a tight target list. You'll miss the mark if you pivot to API management portals.
Full Explanation
Targeting cloud adversary emulation at authorized municipal internet-facing assets such as approved application gateways is the correct practice because continuous simulation only remains safe and useful when the target list matches written scope. County Azure landing zones typically expose Application Gateway (or similar) as the public door; exercising those approved edges validates WAF, TLS, routing, and detection paths without shifting emulation to authorized municipal internet-facing assets such as approved VPN gateways. Keeping emulation aimed at what the county authorized preserves service availability for citizen portals while still producing meaningful purple-team evidence.
Targeting cloud adversary emulation at authorized municipal internet-facing assets such as approved VPN gateways fails by concept: VPN gateways are a different asset class with different exposure and risk, and swapping the target from approved application gateways to VPN gateways breaks the written scope limiting emulation to application gateways only. Targeting cloud adversary emulation at authorized municipal internet-facing assets such as approved front door endpoints fails by concept because a different approved edge type is still not the approved target — front door endpoints sit outside the application-gateway-only target list until a separate scope expansion grants them. Targeting cloud adversary emulation at authorized municipal internet-facing assets such as approved API management portals fails by concept for the same reason: purple work exists to prove detections fire against the approved application gateway, not to shift the targeting focus to API portals rather than the authorized asset list.
Exam caveat: "continuous" simulation still requires rate limits, maintenance windows, and a current allowlist; continuity is not synonymous with extending emulation to approved VPN gateways without separate approval. Operational check: verify the emulation job's target CIDRs/hostnames match the approved application-gateway inventory, that WAF and Azure Monitor alerts remain enabled, and that exercise tags distinguish drill traffic from real attacks.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.