Examkin

Question

Difficulty: HardNetwork Security and Private Access

An organization is designing a secure network environment for a microservices application hosted on Azure Virtual Machine Scale Sets in a dedicated subnet. The application must connect to an Azure Key Vault and an Azure Storage account. Corporate security policy requires restricting outbound traffic to the internet, and the design must minimize administrative effort to maintain security rules as Azure services evolve. Which two actions should you include in the network security design? (Select two.)

  1. Configure an outbound security rule in the Network Security Group (NSG) associated with the subnet that allows traffic to the AzureKeyVault service tag.Answer
  2. Configure an outbound security rule in the Network Security Group (NSG) associated with the subnet that allows traffic to the Storage service tag.Answer
  3. C
    Query the Azure IP Ranges and Service Tags public JSON file weekly, and update individual IP address outbound rules in the Network Security Group (NSG) for Key Vault and Storage endpoints.
  4. D
    Create a User Defined Route (UDR) for the subnet that redirects all 0.0.0.0/00.0.0.0/0 traffic directly to the Storage account public IP addresses to bypass default system routing.
  5. E
    Associate a Basic SKU Public IP address directly to the backend Virtual Machine Scale Sets to allow them to communicate directly with Standard Load Balancer outbound rules.

Answer

Configure outbound security rules in the Network Security Group (NSG) associated with the subnet that allow traffic to the AzureKeyVault and Storage service tags.
The correct configurations involve using Network Security Group (NSG) outbound rules with the AzureKeyVault and Storage service tags. Service tags represent groups of IP address prefixes from Azure services, which Microsoft manages automatically. This satisfies the security requirement to restrict outbound traffic while meeting the constraint to minimize administrative effort, as you do not need to manually track or update IP ranges.

Step-by-Step Solution

1
Identify the target services requiring connection security controls.
The application must establish outbound connections to Azure Key Vault and Azure Storage.
Determines the destination service endpoints that must be defined in the network security rules.
2
Evaluate the rule management overhead constraint.
Determine that Service Tags are the optimal choice to represent IP groups for Azure services since Microsoft manages their updates automatically.
Satisfies the design constraint to minimize administrative effort as Azure IP addresses change.
3
Formulate the correct NSG rules using the appropriate service tags.
Select AzureKeyVault and Storage service tags for the outbound rules.
Allows traffic directly to the target services safely while blocking other unauthorized outbound internet traffic.

Key Concept

Azure Service Tags simplify network security group management by representing groups of IP address prefixes from specific Azure services managed by Microsoft.
Estimated Time:2m 0s
Rate this question

Topics

Network Security and Private Access

More questions from this topic