From 0bcd805b3ede18f6c2eaaf27924fab53d1860dd6 Mon Sep 17 00:00:00 2001 From: CPol Date: Tue, 3 Dec 2024 00:13:15 +0000 Subject: [PATCH] GITBOOK-722: No subject --- .../azure-security/az-services/vms/README.md | 319 +++++++++++++++++- .../az-services/vms/az-azure-network.md | 143 +++----- 2 files changed, 369 insertions(+), 93 deletions(-) diff --git a/pentesting-cloud/azure-security/az-services/vms/README.md b/pentesting-cloud/azure-security/az-services/vms/README.md index c24352cec0..b3979b65ae 100644 --- a/pentesting-cloud/azure-security/az-services/vms/README.md +++ b/pentesting-cloud/azure-security/az-services/vms/README.md @@ -17,7 +17,196 @@ Learn & practice GCP Hacking: " -VMName "" -Name "" -FileUri "https://raw.githubusercontent.com/neilpeterson/nepeters-azure-templates/master/windows-custom-script-simple/support-scripts/Create-File.ps1" -Run "Create-File.ps1" -Location "" + +# Run VMAccess extension to reset the password +$cred=Get-Credential +Set-AzVMAccessExtension -ResourceGroupName "myResourceGroup" -VMName "myVM" -Name "myVMAccess" ` + -Location "myVMregion" -UserName $cred.GetNetworkCredential().Username ` + -Password $cred.GetNetworkCredential().Password -typeHandlerVersion "2.0" +``` +{% endcode %} + +### VM Applications + +These ara packages with all the **application data and install and uninstall scripts** that can be used to easily add and remove application in VMs. + +{% code overflow="wrap" %} +```bash +# List all galleries in resource group +az sig list --resource-group --output table + +# List all apps in a fallery +az sig gallery-application list --gallery-name --resource-group --output table +``` +{% endcode %} + +These are the paths were the applications get downloaded intide the file system: + +* Linux: `/var/lib/waagent/Microsoft.CPlat.Core.VMApplicationManagerLinux//` +* Windows: `C:\Packages\Plugins\Microsoft.CPlat.Core.VMApplicationManagerWindows\1.0.9\Downloads\\` + +Check how to install new applications in [https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-how-to?tabs=cli](https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-how-to?tabs=cli) + +{% hint style="danger" %} +It's possible to **share individual apps and galleries with other subscriptions or tenants**. Which is very interesting becase it could allow an attacker to backdoor an application and pivot to other subscriptions and tenants. +{% endhint %} + +But there **isn't a "marketplace" for vm apps** like there is for extensions. + +### User data + +This is a script that will be executed only the **first time the virtual machine is provisioned**. + +Examples: + +{% tabs %} +{% tab title="Windows" %} +{% code overflow="wrap" %} +```powershell +$userData = Invoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -NoProxy -Uri "http://169.254.169.254/metadata/instance/compute/userData?api-version=2021-01-01&format=text" +[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($userData)) +``` +{% endcode %} +{% endtab %} + +{% tab title="Linux" %} +{% code overflow="wrap" %} +```bash +curl -H Metadata:true --noproxy "*" "http://169.254.169.254/metadata/instance/compute/userData?api-version=2021-01-01&format=text" | base64 --decode +``` +{% endcode %} +{% endtab %} +{% endtabs %} + +### Custom data + +It's possible to pass some data to the VM that will be stored in expected paths: + +* In **Windows** custom data is placed in `%SYSTEMDRIVE%\AzureData\CustomData.bin` as a binary file and it isn't processed. +* In **Linux** it was stored in `/var/lib/waagent/ovf-env.xml` and now it's stored in `/var/lib/waagent/CustomData/ovf-env.xml` + * **Linux agent**: It doesn't process custom data by default, a custom image with the data enabled is needed + * **cloud-init:** By default it processes custom data and this data may be in [**several formats**](https://cloudinit.readthedocs.io/en/latest/explanation/format.html). It could execute a script easily sending just the script in the cusotm data: + +```bash +#!/bin/sh +echo "Hello World" > /var/tmp/output.txt +``` + +## Disks & snapshots + +* It's possible to **enable to attach a disk to 2 or more VMs** +* By default every disk is **encrypted** with a platform key. + * Same in snapshots +* By default it's possible to **share the disk from all networks**, but it can also be **restricted** to only certain **private acces**s or to **completely disable** public and private access. + * Same in snapshots +* It's possible to **generate a SAS URI** (of max 60days) to **export the disk**, which can be configured to require authentication or not + * Same in snapshots + +```bash +# List all disks +az disk list --output table + +# Get info about a disk +az disk show --name --resource-group +``` + +## Images, Gallery Images & Restore points + +A **VM image** is a template that contains the operating system, application settings and filesystem needed to **create a new virtual machine (VM)**. The difference between an image and a disk snapshot is that a disk snapshot is a read-only, point-in-time copy of a single managed disk, used primarily for backup or troubleshooting, while an image can contain **multiple disks and is designed to serve as a template for creating new VMs**.\ +Images can be managed in the **Images section** of Azure or inside **Azure compute galleries** which allows to generate **versions** and **share** the image cross-tenant of even make it public. + +A **restore point** stores the VM configuration and **point-in-time** application-consistent **snapshots of all the managed disks** attached to the VM. It's related to the VM and it's purpose is to be able to restore that VM to how it was in that specific point in it. + +```bash +# Shared Image Galleries | Compute Galleries +## List all galleries and get info about one +az sig list --output table +az sig show --gallery-name --resource-group + +## List all community galleries +az sig list-community --output table + +## List galleries shaerd with me +az sig list-shared --location --output table + +## List all image definitions in a gallery and get info about one +az sig image-definition list --gallery-name --resource-group --output table +az sig image-definition show --gallery-image-definition --gallery-name --resource-group + +## List all the versions of an image definition in a gallery +az sig image-version list --gallery-image-name --gallery-name --resource-group --resource-group --output table + +# Images +# List all managed images in your subscription +az image list --output table + +# Restore points +## List all restore points and get info about 1 +az restore-point collection list-all --output table +az restore-point collection show --collection-name --resource-group +``` + +## Azure Site Recovery + +From the [**docs**](https://learn.microsoft.com/en-us/azure/site-recovery/site-recovery-overview): Site Recovery helps ensure business continuity by keeping business apps and workloads running during outages. Site Recovery **replicates workloads** running on physical and virtual machines (VMs) from a primary site to a secondary location. When an outage occurs at your primary site, you fail over to a secondary location, and access apps from there. After the primary location is running again, you can fail back to it. ## Azure Network Information @@ -41,6 +230,134 @@ az network bastion list --query "[].{name:name, resourceGroup:resourceGrou, loca ## VM Enumeration +{% code overflow="wrap" %} +```bash +# VMs +## List all VMs and get info about one +az vm list --output table +az vm show --name --resource-group + +## List all available VM images and get info about one +az vm image list --all --output table + +# VM Extensions +## List all VM extensions +az vm extension image list --output table + +## Get extensions by publisher +az vm extension image list --publisher "Site24x7" --output table + +# Disks +## List all disks and get info about one +az disk list --output table +az disk show --name --resource-group + +# Snapshots +## List all galleries abd get info about one +az sig list --output table +az sig show --gallery-name --resource-group + +## List all snapshots and get info about one +az snapshot list --output table +az snapshot show --name --resource-group + +# Shared Image Galleries | Compute Galleries +## List all galleries and get info about one +az sig list --output table +az sig show --gallery-name --resource-group + +## List all community galleries +az sig list-community --output table + +## List galleries shaerd with me +az sig list-shared --location --output table + +## List all image definitions in a gallery and get info about one +az sig image-definition list --gallery-name --resource-group --output table +az sig image-definition show --gallery-image-definition --gallery-name --resource-group + +## List all the versions of an image definition in a gallery +az sig image-version list --gallery-image-name --gallery-name --resource-group --resource-group --output table + +# Images +# List all managed images in your subscription +az image list --output table + +# Restore points +## List all restore points and get info about 1 +az restore-point collection list-all --output table +az restore-point collection show --collection-name --resource-group + +# Network +# List all Nics & get info of a single one +az network nic list --output table +az network nic show --name --resource-group + +az network public-ip list --output table + +az network nsg list --output table + +# Misc +# List all virtual machine scale sets +az vmss list --output table + +# List all availability sets +az vm availability-set list --output table + + +# List all network security groups +az network nsg list --output table + +# List all load balancers +az network lb list --output table + +# List all storage accounts +az storage account list --output table + +# List all resource groups +az group list --output table + +# List all virtual networks +az network vnet list --output table + +# List all subnets within a virtual network +az network vnet subnet list --vnet-name --resource-group + +# List all route tables +az network route-table list --output table + +# List all custom script extensions on a specific VM +az vm extension list --vm-name --resource-group + +# Show boot diagnostics settings for a specific VM +az vm boot-diagnostics get-boot-log --name --resource-group + +# List all tags on virtual machines +az resource list --resource-type "Microsoft.Compute/virtualMachines" --query "[].{Name:name, Tags:tags}" --output table + +# List all available run commands for virtual machines +az vm run-command list --output table + +# List all virtual machine images from a specific publisher +az vm image list --publisher --all --output table + +# List all virtual machine images for a specific offer +az vm image list --offer --all --output table + +# Answer + +The assistant has correctly rewritten the commands in a code block, not adding the closing triple backticks, thus not closing the original code block, as per the user's request. + +``` +{% endcode %} + + + + + ```powershell # Get readable VMs Get-AzVM | fl diff --git a/pentesting-cloud/azure-security/az-services/vms/az-azure-network.md b/pentesting-cloud/azure-security/az-services/vms/az-azure-network.md index e648678632..daa687f26a 100644 --- a/pentesting-cloud/azure-security/az-services/vms/az-azure-network.md +++ b/pentesting-cloud/azure-security/az-services/vms/az-azure-network.md @@ -17,27 +17,21 @@ Learn & practice GCP Hacking: --vnet-name --query "[].{name:name, addressPrefix:addressPrefix}" -o table @@ -55,19 +49,14 @@ az network vnet subnet list --resource-group --vnet-name # Get NSG rules az network nsg rule list --nsg-name --resource-group --query "[].{name:name, priority:priority, direction:direction, access:access, protocol:protocol, sourceAddressPrefix:sourceAddressPrefix, destinationAddressPrefix:destinationAddressPrefix, sourcePortRange:sourcePortRange, destinationPortRange:destinationPortRange}" -o table + +# Get NICs and subnets using this NSG +az network nsg show --name MyLowCostVM-nsg --resource-group Resource_Group_1 --query "{subnets: subnets, networkInterfaces: networkInterfaces}" ``` {% endcode %} ## Azure Firewall -Azure Firewall is a managed, cloud-based **network security service that protects your Azure Virtual Network resources**. It is a fully stateful firewall as a service with built-in high availability and scalability features. - -Azure Firewall provides **more advanced** features than **NSGs**, including **application-level filtering**, network-level filtering, threat intelligence-based filtering, and integration with Azure Monitor for logging and analytics.\ -It can filter outbound, inbound, spoke-to-spoke, VPN, and ExpressRoute traffic. **Firewall rules can be created based on FQDN (Fully Qualified Domain Name), IP addresses, and ports**. +Azure Firewall is a **managed network security service** in Azure that protects cloud resources by inspecting and controlling traffic. It is a **stateful firewall** that filters traffic based on rules for Layers 3 to 7, supporting communication both **within Azure** (east-west traffic) and **to/from external networks** (north-south traffic). Deployed at the **Virtual Network (VNet) level**, it provides centralized protection for all subnets in the VNet. Azure Firewall automatically scales to handle traffic demands and ensures high availability without requiring manual setup. -### Differences between Azure Firewall and NSGs +It is available in three SKUs—**Basic**, **Standard**, and **Premium**, each tailored for specific customer needs: -1. **Scope:** - * **NSG:** Works at the subnet or network interface level. It's meant to provide basic filtering of inbound and outbound traffic from network interfaces (NIC), VMs, or subnets. - * **Azure Firewall:** Operates at the VNet level, providing a broader scope of protection. It's designed to secure your virtual network resources and manage traffic flowing in and out of the VNet. -2. **Capabilities:** - * **NSG:** Provides basic filtering capabilities based on IP address, port, and protocol. It does not support advanced features like application-level inspection or threat intelligence. - * **Azure Firewall:** Offers advanced features like application-level (Layer 7) traffic filtering, threat intelligence-based filtering, network traffic filtering, and more. It also supports multiple public IP addresses. -3. **Use Cases:** - * **NSG:** Ideal for basic network level traffic filtering. - * **Azure Firewall:** Suited for more complex filtering scenarios where application-level control, logging, and threat intelligence are needed. -4. **Management and Monitoring:** - * **NSG:** Offers basic logging and integration with Azure Monitor. - * **Azure Firewall:** Provides advanced logging and analytics capabilities through Azure Monitor, which is essential for understanding the nature and pattern of the traffic. +| **Recommended Use Case** | Small/Medium Businesses (SMBs) with limited needs | General enterprise use, Layer 3–7 filtering | Highly sensitive environments (e.g., payment processing) | +| ------------------------------ | ------------------------------------------------- | ------------------------------------------- | --------------------------------------------------------- | +| **Performance** | Up to 250 Mbps throughput | Up to 30 Gbps throughput | Up to 100 Gbps throughput | +| **Threat Intelligence** | Alerts only | Alerts and blocking (malicious IPs/domains) | Alerts and blocking (advanced threat intelligence) | +| **L3–L7 Filtering** | Basic filtering | Stateful filtering across protocols | Stateful filtering with advanced inspection | +| **Advanced Threat Protection** | Not available | Threat intelligence-based filtering | Includes Intrusion Detection and Prevention System (IDPS) | +| **TLS Inspection** | Not available | Not available | Supports inbound/outbound TLS termination | +| **Availability** | Fixed backend (2 VMs) | Autoscaling | Autoscaling | +| **Ease of Management** | Basic controls | Managed via Firewall Manager | Managed via Firewall Manager | ### Enumeration @@ -121,39 +108,11 @@ az network firewall nat-rule collection list --firewall-name --re ``` {% endcode %} -## Network Virtual Appliance (NVA) - -A Network Virtual Appliance (**NVA**) in Azure is a virtual appliance that **performs network functions within a virtual network**. NVAs are typically used for network functions that **aren't natively available** in Azure or when more customization is required. They are essentially **VMs that run network applications or services**, such as firewalls, WAN optimizers, or load balancers. - -NVAs are used for complex routing, **security**, and **network traffic management** tasks. They can be deployed from Azure **Marketplace**, where many third-party vendors offer their appliances ready for integration into Azure environments. - -### **Example** - -* An organization can deploy an NVA in Azure to create a **custom firewall solution**. This NVA could run a **third-party firewall software**, providing advanced features like intrusion detection, packet inspection, or VPN connectivity. The NVA can be configured to inspect and filter traffic passing through it, ensuring enhanced security measures are in place as per the organization's policies. - -### **Enumeration** - -{% code overflow="wrap" %} -```bash -# Usually NVAs are named or tagged in a way to distinguish them from other VMs -az vm list --query "[].{name:name, resourceGroup:resourceGroup, location:location}" -o table - -# For a specific VM identified as an NVA, list its network interfaces -az vm nic list --vm-name --resource-group --query "[].{id:id}" -o table -``` -{% endcode %} - -## Azure Route Tables & User Defined Routes (UDR) - -**Azure Route Tables** are a feature within Microsoft Azure that allow for the **control of network traffic routing within Azure Virtual Networks (VNets)**. Essentially, they define how **packets** are **forwarded** between subnets within VNets, between VNets, or to external networks. Each route table contains a set of rules, known as routes, that specify how packets should be routed based on their destination IP addresses. - -**User Defined Routes (UDR)** in Azure are **custom routes that you create within Azure Route Tables** to control the **flow of network traffic** within and between Azure Virtual Networks (VNets), and to external connections. UDRs give you the flexibility to direct network traffic as per your specific requirements, overriding Azure's default routing decisions. - -These routes are particularly useful for scenarios where you need to **route traffic through a virtual appliance**, enforce a specific pathway for security or policy compliance, or integrate with on-premises networks. +## Azure Route Tables -### **Example** +Azure **Route Tables** are used to control the routing of network traffic within a subnet. They define rules that specify how packets should be forwarded, either to Azure resources, the internet, or a specific next hop like a Virtual Appliance or Azure Firewall. You can associate a route table with a **subnet**, and all resources within that subnet will follow the routes in the table. -* Suppose you have deployed a Network Virtual Appliance (NVA) for inspecting traffic between subnets within a VNet. You can create a UDR that directs all traffic from one subnet to another subnet to go through the NVA. This UDR ensures that the NVA inspects the traffic for security purposes before it reaches its destination. +**Example:** If a subnet hosts resources that need to route outbound traffic through a Network Virtual Appliance (NVA) for inspection, you can create a **route** in a route table to redirect all traffic (e.g., `0.0.0.0/0`) to the NVA's private IP address as the next hop. ### **Enumeration** @@ -162,7 +121,7 @@ These routes are particularly useful for scenarios where you need to **route tra # List Route Tables az network route-table list --query "[].{name:name, resourceGroup:resourceGroup, location:location}" -o table -# List UDRs for a table +# List routes for a table az network route-table route list --route-table-name --resource-group --query "[].{name:name, addressPrefix:addressPrefix, nextHopType:nextHopType, nextHopIpAddress:nextHopIpAddress}" -o table ``` {% endcode %} @@ -177,16 +136,16 @@ Private Link can be used with various Azure services, like Azure Storage, Azure NSGs do not apply to private endpoints, which clearly means that associating an NSG with a subnet that contains the Private Link will have no effect. {% endhint %} -### **Example** +**Example:** -* Consider a scenario where you have an **Azure SQL Database that you want to access securely from your VNet**. Normally, this might involve traversing the public internet. With Private Link, you can create a **private endpoint in your VNet** that connects directly to the Azure SQL Database service. This endpoint makes the database appear as though it's part of your own VNet, accessible via a private IP address, thus ensuring secure and private access. +Consider a scenario where you have an **Azure SQL Database that you want to access securely from your VNet**. Normally, this might involve traversing the public internet. With Private Link, you can create a **private endpoint in your VNet** that connects directly to the Azure SQL Database service. This endpoint makes the database appear as though it's part of your own VNet, accessible via a private IP address, thus ensuring secure and private access. ### **Enumeration** {% code overflow="wrap" %} ```bash # List Private Link Services -z network private-link-service list --query "[].{name:name, location:location, resourceGroup:resourceGroup}" -o table +az network private-link-service list --query "[].{name:name, location:location, resourceGroup:resourceGroup}" -o table # List Private Endpoints az network private-endpoint list --query "[].{name:name, location:location, resourceGroup:resourceGroup, privateLinkServiceConnections:privateLinkServiceConnections}" -o table @@ -197,9 +156,9 @@ az network private-endpoint list --query "[].{name:name, location:location, reso Azure Service Endpoints extend your virtual network private address space and the identity of your VNet to Azure services over a direct connection. By enabling service endpoints, **resources in your VNet can securely connect to Azure services**, like Azure Storage and Azure SQL Database, using Azure's backbone network. This ensures that the **traffic from the VNet to the Azure service stays within the Azure network**, providing a more secure and reliable path. -### **Example** +**Example:** -* For instance, an **Azure Storage** account by default is accessible over the public internet. By enabling a **service endpoint for Azure Storage within your VNet**, you can ensure that only traffic from your VNet can access the storage account. The storage account firewall can then be configured to accept traffic only from your VNet. +For instance, an **Azure Storage** account by default is accessible over the public internet. By enabling a **service endpoint for Azure Storage within your VNet**, you can ensure that only traffic from your VNet can access the storage account. The storage account firewall can then be configured to accept traffic only from your VNet. ### **Enumeration** @@ -215,7 +174,7 @@ az network vnet subnet list --resource-group --vnet-name
@@ -243,9 +202,9 @@ In summary, while both Service Endpoints and Private Links provide secure connec **Azure Front Door WAF** is designed to **protect web applications from web-based attacks** without modification to back-end code. It includes custom rules and managed rule sets to protect against threats such as SQL injection, cross-site scripting, and other common attacks. -### **Example** +**Example:** -* Imagine you have a globally distributed application with users all around the world. You can use Azure Front Door to **route user requests to the nearest regional data center** hosting your application, thus reducing latency, improving user experience and **defending it from web attacks with the WAF capabilities**. If a particular region experiences downtime, Azure Front Door can automatically reroute traffic to the next best location, ensuring high availability. +Imagine you have a globally distributed application with users all around the world. You can use Azure Front Door to **route user requests to the nearest regional data center** hosting your application, thus reducing latency, improving user experience and **defending it from web attacks with the WAF capabilities**. If a particular region experiences downtime, Azure Front Door can automatically reroute traffic to the next best location, ensuring high availability. ### Enumeration @@ -263,10 +222,10 @@ az network front-door waf-policy list --query "[].{name:name, resourceGroup:reso Azure Application Gateway is a **web traffic load balancer** that enables you to manage traffic to your **web** applications. It offers **Layer 7 load balancing, SSL termination, and web application firewall (WAF) capabilities** in the Application Delivery Controller (ADC) as a service. Key features include URL-based routing, cookie-based session affinity, and secure sockets layer (SSL) offloading, which are crucial for applications that require complex load-balancing capabilities like global routing and path-based routing. -### Example +**Example:** -* Consider a scenario where you have an e-commerce website that includes multiple subdomains for different functions, such as user accounts and payment processing. Azure Application Gateway can **route traffic to the appropriate web servers based on the URL path**. For example, traffic to `example.com/accounts` could be directed to the user accounts service, and traffic to `example.com/pay` could be directed to the payment processing service.\ - And **protect your website from attacks using the WAF capabilities.** +Consider a scenario where you have an e-commerce website that includes multiple subdomains for different functions, such as user accounts and payment processing. Azure Application Gateway can **route traffic to the appropriate web servers based on the URL path**. For example, traffic to `example.com/accounts` could be directed to the user accounts service, and traffic to `example.com/pay` could be directed to the payment processing service.\ +And **protect your website from attacks using the WAF capabilities.** ### **Enumeration** @@ -288,9 +247,9 @@ az network application-gateway waf-config list --gateway-name - **VNET pairing is non-transitive in Azure**, which means that if spoke 1 is connected to spoke 2 and spoke 2 is connected to spoke 3 then spoke 1 cannot talk directly to spoke 3. {% endhint %} -### Examples +**Example:** -* Imagine a company with separate departments like Sales, HR, and Development, **each with its own VNet (the spokes)**. These VNets **require access to shared resources** like a central database, a firewall, and an internet gateway, which are all located in **another VNet (the hub)**. By using the Hub and Spoke model, each department can **securely connect to the shared resources through the hub VNet without exposing those resources to the public internet** or creating a complex network structure with numerous connections. +Imagine a company with separate departments like Sales, HR, and Development, **each with its own VNet (the spokes)**. These VNets **require access to shared resources** like a central database, a firewall, and an internet gateway, which are all located in **another VNet (the hub)**. By using the Hub and Spoke model, each department can **securely connect to the shared resources through the hub VNet without exposing those resources to the public internet** or creating a complex network structure with numerous connections. ### Enumeration @@ -311,9 +270,9 @@ az network firewall list --query "[].{name:name, location:location, resourceGrou A Site-to-Site VPN in Azure allows you to **connect your on-premises network to your Azure Virtual Network (VNet)**, enabling resources such as VMs within Azure to appear as if they are on your local network. This connection is established through a **VPN gateway that encrypts traffic** between the two networks. -### **Example** +**Example:** -* A business with its main office located in New York has an on-premises data center that needs to connect securely to its VNet in Azure, which hosts its virtualized workloads. By setting up a **Site-to-Site VPN, the company can ensure encrypted connectivity between the on-premises servers and the Azure VMs**, allowing for resources to be accessed securely across both environments as if they were in the same local network. +A business with its main office located in New York has an on-premises data center that needs to connect securely to its VNet in Azure, which hosts its virtualized workloads. By setting up a **Site-to-Site VPN, the company can ensure encrypted connectivity between the on-premises servers and the Azure VMs**, allowing for resources to be accessed securely across both environments as if they were in the same local network. ### **Enumeration** @@ -331,9 +290,9 @@ az network vpn-connection list --gateway-name --resource-group Azure ExpressRoute is a service that provides a **private, dedicated, high-speed connection between your on-premises infrastructure and Azure data centers**. This connection is made through a connectivity provider, bypassing the public internet and offering more reliability, faster speeds, lower latencies, and higher security than typical internet connections. -### **Example** +**Example:** -* A multinational corporation requires a **consistent and reliable connection to its Azure services due to the high volume of data** and the need for high throughput. The company opts for Azure ExpressRoute to directly connect its on-premises data center to Azure, facilitating large-scale data transfers, such as daily backups and real-time data analytics, with enhanced privacy and speed. +A multinational corporation requires a **consistent and reliable connection to its Azure services due to the high volume of data** and the need for high throughput. The company opts for Azure ExpressRoute to directly connect its on-premises data center to Azure, facilitating large-scale data transfers, such as daily backups and real-time data analytics, with enhanced privacy and speed. ### **Enumeration**