A company is designing a secure hub-and-spoke network topology in Azure. The hub virtual n… — Microsoft Azure Solutions Architect (AZ-305)

A company is designing a secure hub-and-spoke network topology in Azure. The hub virtual network contains an Azure Firewall with the private IP address $10.1.1.4$ . The spoke virtual network uses the address space $10.2.0.0/16$ and contains two subnets: `Prod-App-Subnet` ( $10.2.1.0/24$ ) hosting application virtual machines associated with the Application Security Group (ASG) `AppVM-ASG`, and `Prod-Db-Subnet` ( $10.2.2.0/24$ ) hosting a private endpoint for an Azure SQL Database with the private IP address $10.2.2.5$ .

The network security design must satisfy the following technical requirements:
1. All traffic from `Prod-App-Subnet` to the Azure SQL Database private endpoint must be routed through and inspected by the Azure Firewall.
2. The Network Security Group (NSG) associated with `Prod-App-Subnet` must allow outbound database traffic to the private endpoint while blocking all other outbound traffic to the public internet.
3. Administrative overhead for managing network rules and IP changes must be minimized.
4. Network security policies must be enforced on `Prod-Db-Subnet`.

Which configuration should you recommend to meet these requirements?

Associate a route table with `Prod-App-Subnet` containing a route for $10.2.2.5/32$ with a next hop of $10.1.1.4$ . In the NSG for `Prod-App-Subnet`, add an outbound rule allowing traffic from `AppVM-ASG` to destination $10.2.2.5$ on port $1433$ , and a rule denying outbound traffic to the `Internet` Service Tag. Enable private endpoint network policies on `Prod-Db-Subnet`.Answer
B
Associate a route table with `Prod-App-Subnet` containing a route for $10.0.0.0/8$ with a next hop of $10.1.1.4$ . In the NSG for `Prod-App-Subnet`, add an outbound rule allowing traffic from `AppVM-ASG` to destination $10.2.2.5$ on port $1433$ , and a rule denying outbound traffic to the `Internet` Service Tag. Enable private endpoint network policies on `Prod-Db-Subnet`.
C
Associate a route table with `Prod-App-Subnet` containing a route for $10.2.2.5/32$ with a next hop of $10.1.1.4$ . In the NSG for `Prod-App-Subnet`, add an outbound rule allowing traffic from `AppVM-ASG` to the `Sql` Service Tag on port $1433$ , and a rule denying outbound traffic to the `Internet` Service Tag. Enable private endpoint network policies on `Prod-Db-Subnet`.
D
Associate a route table with `Prod-App-Subnet` containing a route for $10.2.2.5/32$ with a next hop of $10.1.1.4$ . In the NSG for `Prod-App-Subnet`, add an outbound rule allowing traffic from `AppVM-ASG` to destination $10.2.2.5$ on port $1433$ , and manually configure rules to block individual public IP address ranges on the internet. Enable private endpoint network policies on `Prod-Db-Subnet`.

Answer

Associate a route table with the application subnet containing a specific /32 route for the private endpoint pointing to the Azure Firewall private IP. Configure the application subnet's NSG to allow outbound traffic to the private endpoint IP on port 1433 and block the Internet Service Tag. Finally, ensure that private endpoint network policies are enabled on the database subnet.

To force traffic destined for the database private endpoint through the Azure Firewall, you must define a custom route that is more specific than the system-defined local virtual network route (

10.2.0.0/16

). A route pointing to

10.2.2.5/32

with the next hop of the firewall private IP (

10.1.1.4

) successfully achieves this. Because private endpoints resolve to private IP addresses, the application subnet's NSG must allow outbound traffic targeting the specific private IP (

10.2.2.5

) instead of the public `Sql` Service Tag. Using the `Internet` Service Tag to deny outbound traffic blocks all other public web access while minimizing administrative overhead. Finally, enabling private endpoint network policies on the destination subnet ensures that traffic rules are correctly enforced.

Step-by-Step Solution

Evaluate routing precedence between user-defined routes (UDRs) and default system routes.

A route to

10.2.2.5/32

is more specific than the system route

10.2.0.0/16

(Local), forcing traffic through the firewall. A route to

10.0.0.0/8

is less specific than

10.2.0.0/16

, which would cause the firewall to be bypassed.

Azure routing always selects the route with the longest prefix match (most specific route) first.

Analyze how NSG rules match traffic directed to Private Endpoints.

Since the private endpoint uses a private IP address within the VNet (

10.2.2.5

), public Service Tags like `Sql` will not match this traffic. The NSG rule must explicitly target the private IP address.

Service Tags only resolve to public IP ranges of Azure services, not private IPs allocated to private endpoints.

Apply the principle of least privilege and low administrative overhead for internet blocking.

Use the built-in `Internet` Service Tag to deny outbound traffic, rather than maintaining hundreds of individual rules for external public IP ranges.

Maintaining individual IP rules manually introduces massive administrative overhead and is prone to errors.

Verify database subnet policies.

Ensure private endpoint network policies are enabled on `Prod-Db-Subnet`.

If private endpoint network policies are disabled, NSGs and UDRs applied to the subnet hosting the private endpoint will not be enforced.

Key Concept

Enforcing custom routing and security rules on traffic destined for private endpoints in a hub-and-spoke VNet topology.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic