Examkin

Question

Difficulty: MediumNetwork Security and Private Access

You are designing a network security solution for an Azure virtual network. A subnet named Subnet1 contains 30 Azure virtual machines that need to retrieve cryptographic keys from Azure Key Vault. You must allow these virtual machines to make outbound connections to Azure Key Vault while blocking all other outbound access to the public internet. The solution must minimize the administrative effort required to maintain network security rules. Which of the following should you recommend including in the design?

  1. A Network Security Group (NSG) associated with Subnet1 that contains an outbound security rule allowing traffic where the destination is the AzureKeyVault service tag, followed by an outbound rule blocking all traffic to the Internet service tag.Answer
  2. B
    A Network Security Group (NSG) associated with Subnet1 that contains outbound security rules explicitly listing the IP address ranges of the regional Azure Key Vault endpoints, managed and updated via a custom automation script.
  3. C
    An Application Security Group (ASG) configured to group the public IP addresses of the Azure Key Vault service, associated with an outbound security rule on the Subnet1 Network Security Group (NSG).
  4. D
    A User Defined Route (UDR) associated with Subnet1 that routes all outbound traffic destined for the Azure Key Vault service to a virtual network appliance, while dropping all other outbound traffic.

Answer

A Network Security Group (NSG) associated with Subnet1 that contains an outbound security rule allowing traffic where the destination is the AzureKeyVault service tag, followed by an outbound rule blocking all traffic to the Internet service tag.
The correct option recommends using a Network Security Group (NSG) with the built-in AzureKeyVault service tag to allow traffic to Azure Key Vault, followed by a rule blocking traffic to the Internet service tag. Service tags simplify NSG rule creation and maintenance by representing a group of IP address prefixes from a given Azure service. Azure manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, satisfying the constraint to minimize administrative effort.

Step-by-Step Solution

1
Identify the destination service that the virtual machines need to communicate with, which is Azure Key Vault.
Determine that Azure Key Vault has a built-in Service Tag named AzureKeyVault.
Using service tags avoids the need to maintain static IP address lists, reducing administrative overhead.
2
Determine the rule hierarchy needed to permit the desired traffic while blocking all other outbound internet traffic.
Create an allow rule for the AzureKeyVault service tag and a deny rule for the Internet service tag with a lower priority.
NSG rules are processed in priority order, so the allow rule must be evaluated before the broader block rule.
3
Associate the configured NSG with Subnet1.
The network security rules are applied to all virtual machines within Subnet1.
Associating the NSG at the subnet level ensures uniform security policy application.

Key Concept

Azure Network Security Group Service Tags
Rate this question

Topics

Network Security and Private Access

More questions from this topic