Vortex Logistics is designing a secure architecture in Azure. They have a virtual network named VNet1 that contains a subnet named BackendSubnet. The virtual machines in BackendSubnet need to access an Azure Storage account named store1 and an Azure SQL Database named db1 privately without exposing the data traffic to the public internet. The solution must minimize administrative overhead and avoid using static IP listings or manual routing updates. Which two actions should you include in the design to meet these requirements?
- Create Private Endpoints for store1 and db1 within BackendSubnet.Answer
- Configure Azure Private DNS zones integrated with VNet1 to resolve the fully qualified domain names (FQDNs) of store1 and db1.Answer
- CAdd outbound security rules to the Network Security Group (NSG) on BackendSubnet targeting the individual public IP addresses of the Microsoft SQL and Storage endpoints.
- DConfigure a User-Defined Route (UDR) in BackendSubnet that routes all traffic destined for Azure Storage and SQL Database through a virtual network gateway to an on-premises firewall.
Answer
To meet the requirements, you should create Private Endpoints for the storage account and SQL database within the backend subnet, and configure Azure Private DNS zones integrated with the virtual network to handle FQDN resolution.
Creating Private Endpoints assigns private IP addresses from the subnet to the Azure Storage account and Azure SQL Database, ensuring that all data traffic remains within the private Microsoft backbone network and is not exposed to the public internet. Because Private Endpoints require proper name resolution to resolve the service FQDNs to these private IPs, configuring and linking Azure Private DNS zones is necessary to ensure virtual machines can connect successfully.
Step-by-Step Solution
Key Concept
Implementing private access to Azure PaaS resources using Private Endpoints and Private DNS Zones to secure data traffic and avoid public internet exposure.