A multinational finance company is designing a secure hybrid networking architecture in Az… — Microsoft Azure Solutions Architect (AZ-305)

A multinational finance company is designing a secure hybrid networking architecture in Azure. The architecture must connect their on-premises datacenter to an Azure virtual network ( $VNet1$ ) via an ExpressRoute circuit. The company is deploying an Azure SQL Database named $FinanceDB1$ and wants to ensure that:

- VMs in $VNet1$ and on-premises database client tools can access $FinanceDB1$ privately.
- VMs in $VNet1$ are strictly blocked from accessing any other Azure SQL Database instances in any region (preventing database data exfiltration).
- The on-premises clients must resolve the private endpoint of $FinanceDB1$ using their existing local DNS servers.
- Administrative overhead and maintenance of custom DNS forwarder virtual machines must be minimized.

Which two configurations should you include in the design?

Configure a Private Endpoint for $FinanceDB1$ in $VNet1$ , and apply a Network Security Group (NSG) to the VM subnet that permits outbound traffic to the Private Endpoint's private IP address and denies outbound traffic to the `Sql` service tag.Answer
Deploy an Azure DNS Private Resolver in Azure with an inbound endpoint, and configure the on-premises DNS servers with a conditional forwarder for `privatelink.database.windows.net` pointing to the inbound endpoint's private IP address.Answer
C
Create a custom Route Table associated with the VM subnet and add a User Defined Route (UDR) that routes traffic destined for $168.63.129.16$ to the ExpressRoute gateway.
D
Apply a Network Security Group (NSG) to the VM subnet with individual outbound security rules denying traffic to the specific public IP address ranges of the Azure SQL Database gateways in the region.

Answer

To meet the requirements, the design must configure a Private Endpoint for the database and apply a Network Security Group to the VM subnet that allows outbound traffic to the Private Endpoint's private IP while blocking the Sql service tag. It must also deploy an Azure DNS Private Resolver with an inbound endpoint to resolve the private endpoint FQDN from the on-premises DNS servers.

The correct architecture combines Private Endpoints for private database access with NSGs that allow traffic to the private endpoint IP while blocking the Sql service tag, effectively preventing data exfiltration to other public SQL databases. For hybrid DNS resolution, an Azure DNS Private Resolver with an inbound endpoint allows on-premises DNS servers to forward queries for private link zones without the overhead of custom DNS VM forwarders.

Step-by-Step Solution

Enable private access and prevent database data exfiltration.

Create a Private Endpoint for the database, and configure an NSG on the VM subnet that allows outbound traffic to the private IP address of the Private Endpoint but denies outbound traffic to the `Sql` service tag.

Traffic to the private endpoint uses the private IP address, which bypasses the `Sql` service tag block. This prevents VMs from accessing other Azure SQL databases via their public endpoints while maintaining access to the designated database.

Establish secure hybrid DNS resolution with minimal administrative effort.

Deploy an Azure DNS Private Resolver with an Inbound Endpoint in Azure, and configure a conditional forwarder on the on-premises DNS servers pointing to the resolver's private IP.

This avoids maintaining custom DNS forwarder virtual machines and enables on-premises DNS queries for the private link zone to be forwarded to Azure's internal DNS resolver.

Key Concept

Designing secure hybrid network access and private DNS resolution in Azure.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic