Examkin

Question

Difficulty: MediumNetwork Security and Private Access

NovaBio Research is designing a secure network architecture in Azure to support a team of remote laboratory researchers. The researchers must connect to Azure Virtual Machines deployed in a private subnet.

The architecture must meet the following requirements:
* Remote researchers must be able to establish secure, encrypted, client-based connections to the virtual machines over the public internet without exposing the virtual machines directly to the internet.
* The virtual machines must be prevented from initiating outbound connections to the internet, except for necessary data uploads to Azure Storage.

Which two actions should you perform to meet the requirements?

  1. Configure a Network Security Group (NSG) associated with the VM subnet with an outbound rule that denies outbound traffic to the Internet, and a higher-priority outbound rule that allows outbound traffic to the Storage service tag.Answer
  2. B
    Configure a Network Security Group (NSG) associated with the VM subnet to block outbound internet traffic, and manually add individual outbound rules for all Azure Storage public IP address ranges in the region.
  3. Deploy an Azure VPN Gateway in the virtual network and configure Point-to-Site (P2S) VPN connections for the remote researchers.Answer
  4. D
    Create a User Defined Route (UDR) on the VM subnet that redirects all outbound traffic to the Internet, and add overlapping custom routes that override system-defined routes for virtual network communication.

Answer

To meet the security requirements, you should deploy an Azure VPN Gateway in the virtual network and configure Point-to-Site (P2S) VPN connections for remote client access, and configure an NSG on the VM subnet with an outbound deny rule for the Internet and a higher-priority outbound allow rule for the Storage service tag.
Deploying an Azure VPN Gateway configured for Point-to-Site (P2S) VPN provides secure, client-based connection over the internet directly to the private subnet without public endpoints on the virtual machines. Additionally, configuring an NSG with an outbound rule denying internet access alongside a higher-priority rule allowing traffic to the Storage service tag ensures VMs can only upload data to Azure Storage and cannot access the rest of the public internet.

Step-by-Step Solution

1
Address remote secure client access.
Identify Point-to-Site (P2S) VPN as the secure client-based connection method over the public internet to the virtual network.
This satisfies the requirement to allow remote researchers to connect securely without public IP exposure on the virtual machines.
2
Configure outbound access controls.
Use Network Security Groups (NSGs) with built-in service tags to block general outbound internet access while permitting traffic specifically to Azure Storage.
This meets the security requirement with minimal administrative effort by avoiding manually tracking and updating target IP addresses.

Key Concept

Designing secure network connectivity and access control using VPN Gateway and Network Security Groups with Service Tags.
Rate this question

Topics

Network Security and Private Access

More questions from this topic