An enterprise architecture team is implementing a hub-and-spoke virtual network topology in Azure for a secure payment application. The hub virtual network hosts an Azure Firewall with the private IP address . A spoke virtual network named `VNet1` contains two subnets:
* `Subnet1` (): Contains Azure Virtual Machines hosting the payment application.
* `Subnet2` (): Contains a Private Endpoint (IP address ) for a secure Azure SQL Database.
You must ensure that all traffic from the Virtual Machines in `Subnet1` to the SQL Database Private Endpoint in `Subnet2` is inspected by the Azure Firewall. The design must also enforce network security group (NSG) rules on both subnets.
Which two actions should you perform? (Select two.)
- Enable private endpoint network policies for route tables and network security groups on Subnet2.Answer
- Associate a route table to Subnet1 containing a route to the private endpoint IP address, and associate a route table to Subnet2 containing a route to Subnet1, with both route tables pointing to the Azure Firewall as the next hop.Answer
- CManually configure individual outbound security rules in the Network Security Group (NSG) associated with Subnet1 for each database server IP address to allow traffic.
- DAssociate an Azure SQL service endpoint policy to Subnet1 to restrict outbound traffic to only the permitted SQL Database.
- EConfigure a user-defined route (UDR) in Subnet1 that routes traffic destined for the SQL database to the Azure Firewall, but keep the private endpoint network policies disabled on Subnet2 to prevent routing loops.
- FConfigure a route table associated with Subnet2 with a default route () pointing to the Azure Firewall, without enabling private endpoint network policies on Subnet2.
Answer
Enable private endpoint network policies on the subnet hosting the private endpoint (Subnet2), and configure route tables on both Subnet1 (destination private endpoint IP via the firewall) and Subnet2 (destination Subnet1 IP via the firewall) to ensure symmetric traffic inspection.
To force traffic destined for the private endpoint through Azure Firewall, we must configure a user-defined route (UDR) on the source subnet (Subnet1) pointing to the firewall. However, because Azure Firewall is stateful, the return traffic from the private endpoint back to the VMs must also go through the firewall. This requires a corresponding UDR on the destination subnet (Subnet2) pointing to the firewall. For this UDR and any NSG rules to be active and applied to the private endpoint network interface, we must enable private endpoint network policies on the subnet hosting the private endpoint (Subnet2).
Step-by-Step Solution
Key Concept
Enforcing security inspection and NSG rules on Private Endpoints in Azure requires enabling private endpoint network policies on the hosting subnet, and configuring symmetric user-defined routes on both the source and destination subnets.
Alternative Method
Instead of using Azure Firewall for inspection, you could use a third-party Network Virtual Appliance (NVA) deployed in the hub virtual network, which would require the same UDR and private endpoint network policy configurations on the subnets.
Estimated Time:3m 0s