Examkin

Question

Difficulty: MediumNetwork Security and Private Access

Your company is designing a secure network architecture in Azure. You have a virtual network named VNet1 containing a subnet named AppSubnet. Virtual machines in AppSubnet must connect to Azure Key Vault and Azure Storage.

The security team has the following requirements:
- Direct public internet connectivity from AppSubnet must be blocked.
- Administrative overhead for maintaining IP address changes of Azure services must be minimized.
- Communication with Azure Storage and Azure Key Vault must be allowed, while all other outbound traffic is denied.

You decide to use a Network Security Group (NSG) associated with AppSubnet to control outbound traffic.

Which two configurations should you recommend for the Network Security Group (NSG) outbound rules? (Select two.)

  1. An outbound security rule that allows traffic to the Storage service tag.Answer
  2. An outbound security rule that allows traffic to the AzureKeyVault service tag.Answer
  3. C
    A series of outbound security rules containing the individual public IP address ranges of the regional Azure Storage and Azure Key Vault endpoints.
  4. D
    A custom route table associated with AppSubnet containing User Defined Routes (UDRs) that forward all traffic to the default internet gateway to resolve the Azure service endpoints.

Answer

Configure an outbound security rule that allows traffic to the Storage service tag, and configure an outbound security rule that allows traffic to the AzureKeyVault service tag.
To satisfy the requirements of securing outbound communication to Azure Storage and Azure Key Vault while avoiding administrative overhead, you should use Azure Service Tags in the Network Security Group. A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing administrative effort.

Step-by-Step Solution

1
Identify the target Azure services that the virtual machines in AppSubnet need to access.
The target services are Azure Storage and Azure Key Vault.
This establishes the scope of traffic that must be explicitly permitted through the security controls.
2
Evaluate the mechanism that minimizes administrative overhead for maintaining changing service IP addresses.
Azure Service Tags represent groups of IP address prefixes managed entirely by Microsoft.
Using Service Tags like 'Storage' and 'AzureKeyVault' eliminates the need to manually track and update rule IP addresses when Azure updates service endpoints.
3
Formulate the outbound rules for the Network Security Group.
Add two high-priority outbound rules to allow the Storage and AzureKeyVault service tags as destinations, combined with a default or lower-priority rule to block all other outbound internet traffic.
This satisfies the security requirement to block general internet access while allowing access only to the authorized Azure services.

Key Concept

Azure Network Security Group Service Tags
Rate this question

Topics

Network Security and Private Access

More questions from this topic