Examkin

Question

Difficulty: EasyNetwork Security and Private Access

A company has virtual machines (VMs) deployed in a subnet of an Azure virtual network. The VMs must securely access Azure Storage accounts. The design must block all general outbound internet traffic, prevent the need to manually update rules when Azure Storage IP addresses change, and minimize administrative overhead. Which two configurations should you include in the network security design?

  1. Configure an outbound Network Security Group (NSG) rule with the destination set to the Storage service tag.Answer
  2. Enable a virtual network service endpoint for Storage on the subnet.Answer
  3. C
    Manually create individual NSG outbound rules for each public IP address range used by Azure Storage.
  4. D
    Create a User Defined Route (UDR) that overrides internal system routes to redirect all outbound storage traffic to a public proxy server.

Answer

Configure an outbound Network Security Group (NSG) rule using the Storage service tag and enable a virtual network service endpoint for Storage on the subnet.
Configuring an outbound Network Security Group (NSG) rule with the Storage service tag allows traffic to reach Azure Storage without manual IP updates, and enabling a service endpoint on the subnet ensures that this traffic is routed privately over the Microsoft backbone network.

Step-by-Step Solution

1
Determine the outbound traffic requirements for the virtual machines.
VMs must connect to Azure Storage, but general outbound internet traffic must be restricted.
This establishes the security boundaries for the subnet's egress traffic.
2
Select a method to manage IP address ranges dynamically for the destination rules.
Use the Storage service tag as the destination for the NSG outbound rule.
Service tags group IP address prefixes for Azure services, managed automatically by Microsoft to avoid manual rule maintenance.
3
Select a routing path that ensures private and secure access to Azure Storage.
Enable a virtual network service endpoint for Storage on the VM subnet.
Service endpoints route traffic directly over the Microsoft backbone network, providing private access without sending traffic to the public internet.

Key Concept

Network Security and Private Access using Service Tags and Service Endpoints
Rate this question

Topics

Network Security and Private Access

More questions from this topic