Examkin

Question

Difficulty: HardNetwork Security and Private Access

Your company has an on-premises datacenter connected to an Azure Virtual Network (VNet) via a site-to-site VPN. You are designing a secure private access solution for a business-critical application running on virtual machines in the VNet. The application needs to connect to an Azure SQL Database. You must meet the following requirements:
- The Azure SQL Database must not accept connections from the public internet.
- The virtual machines must access the database using private IP addresses.
- On-premises database administrators must be able to manage the database using private IP addresses.
- On-premises DNS servers must resolve the database FQDN to its private IP address.
- Administrative overhead for security rule maintenance and DNS routing must be minimized.

Which network security design should you recommend?

  1. Deploy a Private Endpoint for the Azure SQL Database. Configure an Azure DNS Private Resolver in the VNet, and set up conditional forwarding on the on-premises DNS servers to route database FQDN queries to the resolver's inbound endpoint. Apply a Network Security Group (NSG) utilizing the SQL Service Tag to secure database traffic.Answer
  2. B
    Deploy a Private Endpoint for the Azure SQL Database. Configure a DNS forwarder VM in Azure to resolve the database FQDN. Apply a Network Security Group (NSG) on the virtual machine subnet containing manual outbound rules for each individual public IP address block of the regional Azure SQL Database gateway endpoints.
  3. C
    Deploy a Service Endpoint for the Azure SQL Database. Configure a User-Defined Route (UDR) on the virtual machine subnet that routes all database traffic to a virtual appliance, and configure a second overlapping route for the 0.0.0.0/00.0.0.0/0 destination to override system-defined routes for the database connection.
  4. D
    Deploy a Private Endpoint for the Azure SQL Database. Place a Basic Load Balancer in the VNet to distribute traffic to the private endpoint. Associate a Standard SKU Public IP address with the load balancer to allow secure remote administration from the on-premises environment.

Answer

Deploy a Private Endpoint for the Azure SQL Database, configure an Azure DNS Private Resolver with conditional forwarding from on-premises DNS servers, and apply a Network Security Group utilizing the SQL Service Tag.
The correct answer provides a robust network security and private access design. A Private Endpoint ensures that the Azure SQL Database is only accessible via a private IP address, completely blocking public access. Deploying an Azure DNS Private Resolver allows on-premises DNS servers to forward queries to its inbound endpoint, ensuring on-premises clients can resolve the private IP address of the database. Finally, utilizing the SQL Service Tag within the Network Security Group (NSG) restricts outbound database traffic while avoiding the need to manually update rules when IP addresses change, minimizing administrative overhead.

Step-by-Step Solution

1
Select Private Endpoint to satisfy private access and disable public access.
The Azure SQL Database is assigned a private IP address within the VNet, and public internet access can be completely disabled.
Meets the security requirements for private IP access and zero public internet exposure.
2
Deploy Azure DNS Private Resolver to enable hybrid DNS resolution.
On-premises DNS servers can use conditional forwarding to target the resolver's inbound endpoint to resolve the database FQDN to its private IP.
Provides seamless DNS resolution across hybrid connections without the administrative overhead of deploying and patching DNS forwarder VMs.
3
Use Service Tags in Network Security Groups (NSGs) for outbound control.
The NSG uses the SQL Service Tag rather than manually configured IP blocks.
Minimizes administrative overhead since Azure automatically maintains the IP address ranges associated with the Service Tag.

Key Concept

Designing secure hybrid name resolution and private access for Azure PaaS services using Private Endpoints and Azure DNS Private Resolver.
Estimated Time:2m 0s
Rate this question

Topics

Network Security and Private Access

More questions from this topic