Examkin

Question

Difficulty: MediumNetwork Security and Private Access

A company named Zephyr Retail is designing a network security solution for an Azure virtual network subnet named ProcessingSubnet. Virtual machines in ProcessingSubnet must be able to securely access Azure Storage and Azure Key Vault in the same Azure region. All other outbound access to the public internet must be blocked. The solution must minimize administrative overhead and ensure that network rules do not require manual updates when Azure service IP ranges change. Which configuration should you recommend for the Network Security Group (NSG) associated with ProcessingSubnet?

  1. Create outbound security rules in the NSG with the destination set to the Storage and AzureKeyVault Service Tags.Answer
  2. B
    Create outbound security rules in the NSG using the individual IP address ranges of the Azure Storage and Azure Key Vault endpoints.
  3. C
    Create User-Defined Routes (UDRs) that override the default system routes by mapping the subnet's local network traffic to the Azure service public endpoints.
  4. D
    Configure a Basic SKU Load Balancer to proxy outbound connection requests to Azure Storage and Azure Key Vault from virtual machines using Standard SKU public IP addresses.

Answer

Create outbound security rules in the NSG with the destination set to the Storage and AzureKeyVault Service Tags.
Using Service Tags like Storage and AzureKeyVault allows the Network Security Group to dynamically resolve destination IP addresses, ensuring secure and continuously updated access to these services with zero administrative overhead.

Step-by-Step Solution

1
Identify the target public Azure services that the virtual machines need to reach.
Azure Storage and Azure Key Vault in the same region.
This establishes the scope of allowed outbound traffic.
2
Evaluate the administrative requirement to avoid manual IP range updates.
Individual IP addresses are ruled out; a dynamic grouping mechanism must be used.
Azure service IP ranges change frequently, so static IP rules create maintenance overhead.
3
Select the built-in Azure Network Security Group features designed for grouping service IP addresses.
Service Tags (specifically Storage and AzureKeyVault) are selected.
Service Tags are managed by Microsoft and automatically updated, satisfying the requirement to minimize administrative overhead.

Key Concept

Network Security Groups and Service Tags for outbound traffic filtering
Estimated Time:1m 30s
Rate this question

Topics

Network Security and Private Access

More questions from this topic