Examkin

Question

Difficulty: MediumNetwork Security and Private Access

Skyward Aviation is designing a secure network architecture in Azure. You have a virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 hosts several virtual machines that run a legacy application. The virtual machines must access an Azure SQL database and an Azure Storage account. You need to design a network security and private access solution that meets the following requirements:
- Access to the Azure SQL database and Azure Storage account must be restricted to only traffic originating from Subnet1.
- The public IP addresses of the Azure SQL database and Azure Storage account must not be exposed to the virtual machines.
- The virtual machines must connect to the services using private IP addresses.
- Administrative effort to maintain the network configuration must be minimized.

Which two actions should you recommend?

  1. Deploy a Private Endpoint for the Azure SQL database and a Private Endpoint for the Azure Storage account in VNet1.Answer
  2. Configure private DNS zones in Azure for the services and link the zones to VNet1.Answer
  3. C
    Generate a Shared Access Signature (SAS) token with a multi-year validity duration and hardcode it within the application to authenticate to the storage account.
  4. D
    Configure a Network Security Group (NSG) on Subnet1 with outbound rules allowing traffic to the specific public IP addresses of the Azure SQL database and Azure Storage account.
  5. E
    Configure a User Defined Route (UDR) on Subnet1 that utilizes overlapping routes to bypass virtual network system routing and send all database traffic through the default internet gateway.

Answer

To meet the requirements, you should deploy a Private Endpoint for the Azure SQL database and a Private Endpoint for the Azure Storage account in the virtual network, and configure private DNS zones in Azure for the services and link the zones to the virtual network.
Deploying Private Endpoints allocates private IP addresses from the virtual network to the Azure SQL database and Azure Storage account, ensuring all communication remains within the Microsoft backbone network and is not exposed to the public internet. Configuring Private DNS zones and linking them to the virtual network enables the application to automatically resolve the services' FQDNs to their private IPs without manual hosts file updates or custom DNS server management, which minimizes administrative overhead.

Step-by-Step Solution

1
Select the appropriate private access technology.
Private Endpoints are selected because they assign private IP addresses from the virtual network to the services, preventing public IP exposure.
The requirement specifies that virtual machines must connect to the services using private IP addresses and public IP addresses must not be exposed.
2
Ensure proper name resolution for the private endpoints.
Private DNS zones are created for the database and storage services, and linked to the virtual network.
This allows the application to continue using the services' fully qualified domain names (FQDNs) while resolving them to the private IP addresses of the Private Endpoints, keeping administrative effort low.

Key Concept

Private access to Azure services using Private Endpoints and Private DNS Zones to avoid public endpoint exposure.
Rate this question

Topics

Network Security and Private Access

More questions from this topic