Examkin

Question

Difficulty: EasyNetwork Security and Private Access

You need to configure a Network Security Group (NSG) to allow outbound traffic from an Azure virtual network subnet to Azure SQL Database instances. The solution must block all other traffic to the internet, minimize administrative effort, and avoid manual IP address management when Azure services update their IP address ranges. Which destination setting should you specify in the outbound security rule of the Network Security Group?

  1. The Sql Service TagAnswer
  2. B
    A list of individual public IP address ranges for the Azure SQL Database service
  3. C
    An Application Security Group containing the Azure SQL Database service
  4. D
    A User-Defined Route that overrides default system routes to direct traffic through a custom gateway

Answer

The Sql Service Tag
The correct solution is to use the 'Sql' Service Tag as the destination. A Service Tag represents a group of IP address prefixes from a given Azure service. Using service tags eliminates the need to manually update security rules when IP addresses change, minimizing administrative effort.

Step-by-Step Solution

1
Identify the target service requiring outbound connectivity and the administrative constraint.
The target is Azure SQL Database, and the solution must avoid manual IP updates.
This establishes that we need a dynamic referencing mechanism rather than static IP configurations.
2
Select the appropriate Network Security Group destination option that groups the target service's IP addresses.
The built-in 'Sql' Service Tag is selected.
Service tags abstract IP prefixes for specific Azure services and are managed automatically by Microsoft, fulfilling all constraints.

Key Concept

Using Service Tags in Network Security Groups to simplify security rules and eliminate manual IP address maintenance for Azure services.
Estimated Time:45s
Rate this question

Topics

Network Security and Private Access

More questions from this topic