Examkin

Question

Difficulty: MediumNetwork Security and Private Access

An organization is designing the network security for an Azure environment. A subnet named Subnet1 in a virtual network named VNet1 hosts virtual machines that run batch processing jobs. The virtual machines must access Azure Key Vault and Azure SQL Database instances over their public endpoints. You need to configure a Network Security Group (NSG) associated with Subnet1 to restrict outbound traffic so that the virtual machines can access only these specific Azure services and are blocked from all other public internet destinations. The solution must minimize administrative overhead. Which two actions should you recommend?

  1. Create an outbound security rule in the NSG with the destination set to the AzureKeyVault Service Tag.Answer
  2. Create an outbound security rule in the NSG with the destination set to the Sql Service Tag.Answer
  3. C
    Create individual outbound security rules in the NSG for each public IP address range currently used by the Azure Key Vault and SQL Database instances.
  4. D
    Create a custom route table with User-Defined Routes (UDRs) that map individual public IP addresses of the Azure services to the Internet gateway to override default routing.

Answer

Create an outbound security rule in the NSG with the destination set to the AzureKeyVault Service Tag, and create an outbound security rule in the NSG with the destination set to the Sql Service Tag.
To securely allow outbound traffic to Azure Key Vault and Azure SQL Database over public endpoints while blocking all other public internet traffic, you should configure NSG outbound rules using the built-in Service Tags 'AzureKeyVault' and 'Sql'. Service Tags represent the IP address prefixes of these services and are automatically managed and updated by Microsoft, which minimizes administrative overhead.

Step-by-Step Solution

1
Identify the destination services and their public endpoint access requirements.
The virtual machines must access Azure Key Vault and Azure SQL Database over public endpoints.
This determines the scope of outbound traffic that must be permitted.
2
Evaluate options for restricting outbound traffic while minimizing administrative overhead.
Service Tags represent IP address prefixes for specific Azure services and are managed automatically by Microsoft.
Using Service Tags avoids manually tracking and updating individual IP ranges for Azure services in NSG rules.
3
Formulate the correct NSG outbound rules.
Configure rules with destinations set to the AzureKeyVault and Sql Service Tags, and deny all other outbound internet traffic.
This fulfills the security requirement to block other public internet destinations while allowing Key Vault and SQL access.

Key Concept

Using Service Tags in Network Security Groups (NSGs) to manage outbound access to Azure services with minimal administrative overhead.
Estimated Time:1m 30s
Rate this question

Topics

Network Security and Private Access

More questions from this topic