An enterprise is designing a hub-and-spoke network topology in Azure to host a secure mult… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke network topology in Azure to host a secure multi-tier application. The design includes the following components:

* A hub virtual network ( $\text{VNet-Hub}$ ) containing an Azure Firewall and an Azure Private DNS Resolver with an inbound endpoint configured.
* A spoke virtual network ( $\text{VNet-App}$ ) peered with $\text{VNet-Hub}$ . This virtual network contains a subnet named $\text{Subnet-App}$ hosting application virtual machines.
* A spoke virtual network ( $\text{VNet-Data}$ ) peered with $\text{VNet-Hub}$ . This virtual network contains a subnet named $\text{Subnet-Data}$ hosting an Azure SQL Database with a Private Endpoint.
* An Azure Private DNS Zone named `privatelink.database.windows.net` containing the DNS record for the Private Endpoint, linked to $\text{VNet-Hub}$ .

Your design must meet the following requirements:
* The virtual machines in $\text{Subnet-App}$ must connect to the Azure SQL Database using its Private Endpoint.
* All traffic between $\text{Subnet-App}$ and the Private Endpoint must be routed through and inspected by the Azure Firewall in $\text{VNet-Hub}$ .
* You must minimize administrative overhead and avoid linking the Private DNS Zone `privatelink.database.windows.net` to multiple virtual networks.

Which two actions should you perform?

Configure the DNS servers setting of VNet-App to use the IP address of the Azure Private DNS Resolver inbound endpoint.Answer
In the properties of Subnet-Data, enable network policies for private endpoints.Answer
C
Associate a network security group (NSG) with Subnet-App and configure outbound security rules targeting individual public IP addresses of the Azure SQL Database service.
D
In the route table associated with Subnet-App, create a user-defined route with the destination prefix 0.0.0.0/0 and the next hop set to the Private Endpoint IP address.

Answer

Configure the DNS servers setting of VNet-App to use the IP address of the Azure Private DNS Resolver inbound endpoint, and enable network policies for private endpoints on Subnet-Data.

Configuring the DNS server setting of the spoke virtual network to point to the Azure Private DNS Resolver inbound endpoint enables seamless name resolution across VNets without linking the Private DNS Zone directly to every spoke. Furthermore, enabling network policies for private endpoints on the destination data subnet is required so that Azure honors user-defined routes and NSGs, ensuring that database traffic is routed through the firewall instead of bypassing it.

Step-by-Step Solution

Configure DNS resolution for the spoke virtual network.

By setting the DNS server of VNet-App to the Private DNS Resolver's inbound endpoint IP address, VM DNS queries are forwarded to VNet-Hub, which can resolve the private link zone.

This allows the application VMs to resolve the SQL database's private FQDN to its private endpoint IP without creating duplicate links to the DNS zone.

Enable network policies on the private endpoint subnet.

Enabling subnet network policies for private endpoints allows Azure to respect user-defined routes (UDRs) and Network Security Groups (NSGs) on the private endpoint's interface.

By default, UDRs and NSGs are bypassed for private endpoint traffic. Enabling this policy ensures that return traffic from the database back to the application VM is routed through the Azure Firewall.

Associate a route table with Subnet-App routing traffic to the Azure Firewall.

A UDR on Subnet-App directs traffic bound for the SQL Private Endpoint to the Azure Firewall private IP address.

This guarantees that outbound traffic from the application layer to the database layer is inspected by the firewall.

Key Concept

Azure Private Endpoint Routing and DNS Integration in Hub-Spoke Architectures

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic