Examkin

Question

Difficulty: MediumNetwork Security and Private Access

Lumina Financials is designing a secure architecture for a cloud database application deployed on virtual machines in a virtual network subnet named Subnet1. The virtual machines require outbound connectivity to Azure Storage and Azure SQL Database in the same region to perform nightly data transfers. You need to configure a Network Security Group (NSG) associated with Subnet1 to permit outbound traffic to only these services while blocking all other outbound internet traffic. The solution must minimize administrative overhead when IP address ranges for the Azure services change. Which NSG outbound rule configuration should you recommend?

  1. Create outbound rules that use the Storage and Sql Service Tags as the destination.Answer
  2. B
    Create outbound rules that use the individual IP address ranges of the regional Azure Storage and Azure SQL Database endpoints as the destination.
  3. C
    Create an Application Security Group (ASG) containing the Azure SQL and Storage endpoints, and use the ASG as the destination in the outbound rules.
  4. D
    Create User Defined Routes (UDRs) to route all outbound traffic through an Azure Firewall, and manually configure network rules with the individual IP addresses of the Azure services.

Answer

Create outbound rules that use the Storage and Sql Service Tags as the destination.
The correct option is to use the built-in Storage and Sql Service Tags. Service Tags represent a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, which minimizes administrative overhead.

Step-by-Step Solution

1
Identify the destination services requiring access.
Azure Storage and Azure SQL Database are the target services.
The VMs need outbound access to these specific Azure PaaS services.
2
Select the appropriate network security mechanism that minimizes administrative overhead.
Service Tags represent groups of IP address prefixes from managed Azure services.
Using Service Tags eliminates the need to manually track and update IP address ranges.
3
Configure the NSG outbound security rules.
Two rules are created targeting the Storage and Sql Service Tags respectively.
This allows required traffic while a lower-priority rule blocks all other outbound internet traffic.

Key Concept

Azure Service Tags simplify NSG management by representing groups of IP address prefixes for specific Azure services.
Estimated Time:1m 30s
Rate this question

Topics

Network Security and Private Access

More questions from this topic