Examkin

Question

Difficulty: MediumNetwork Security and Private Access

Your company is designing the network security architecture for a new application environment in Azure. The application workloads will run on virtual machines in a subnet named ProductionSubnet. The virtual machines must meet the following requirements:
- Outbound access to the public internet must be blocked.
- The virtual machines must be able to securely store files in an Azure Storage account named storage1 without traversing the public internet.
- The virtual machines must be able to send diagnostic logs to Azure Monitor.
- Administrative overhead for managing network access rules must be minimized.

Which two actions should you include in the recommendation?

  1. Create a Private Endpoint for storage1 in ProductionSubnet.Answer
  2. Associate a Network Security Group (NSG) with ProductionSubnet and configure an outbound security rule that allows traffic to the AzureMonitor service tag.Answer
  3. C
    Associate a Network Security Group (NSG) with ProductionSubnet and configure outbound security rules containing the specific IP address ranges of the Azure Monitor endpoints.
  4. D
    Create a User Defined Route (UDR) in ProductionSubnet that routes 0.0.0.0/0 traffic to the public IP address of storage1.
  5. E
    Deploy a Standard Load Balancer in ProductionSubnet using Basic SKU public IP addresses to provide outbound connectivity.

Answer

To meet the requirements, you must recommend deploying a Private Endpoint for the Azure Storage account and configuring a Network Security Group (NSG) with an outbound rule allowing traffic to the AzureMonitor service tag.
Deploying a Private Endpoint for the storage account assigns it a private IP within the subnet, ensuring traffic does not traverse the public internet. Configuring an NSG outbound rule with the AzureMonitor service tag ensures that virtual machines can safely transmit logs to Azure Monitor while avoiding the administrative overhead of maintaining individual IP addresses.

Step-by-Step Solution

1
Analyze storage access requirements
Determine that private endpoint is needed to keep storage traffic off the public internet
Private Endpoints assign private IP addresses from the virtual network subnet to the Azure service, securing traffic and preventing public internet traversal.
2
Analyze monitoring requirements
Determine that NSG outbound rule must allow traffic to Azure Monitor using a service tag
Using service tags simplifies management because Microsoft automatically maintains the IP addresses within the tag, minimizing administrative effort compared to manually configuring individual IP ranges.
3
Evaluate and eliminate incorrect architectures
Discard solutions proposing manually managed IP rules, Basic/Standard SKU mixing, and invalid UDRs
Mixing basic/standard SKUs fails deployment validation, routing all traffic to a storage public IP is invalid, and manual IP rules violate the administrative overhead constraint.

Key Concept

Designing secure network access and private connectivity using Private Endpoints and NSG Service Tags to minimize administrative overhead.
Rate this question

Topics

Network Security and Private Access

More questions from this topic