Examkin

Question

Difficulty: MediumNetwork Security and Private Access

Helios Energy Services is designing a secure network infrastructure in Azure. A virtual network contains a subnet named Subnet1, which hosts virtual machines (VMs) that run an application. The VMs require access to secrets stored in Azure Key Vault. According to company policy, all outbound internet traffic from Subnet1 must be blocked, except for traffic destined for Azure Key Vault. You need to recommend a network security solution that satisfies the company policy while minimizing administrative overhead. What should you recommend?

  1. Associate a Network Security Group (NSG) with Subnet1. Create an outbound security rule that allows traffic to the AzureKeyVault service tag, and a lower-priority outbound security rule that denies traffic to the Internet service tag.Answer
  2. B
    Associate a Network Security Group (NSG) with Subnet1. Identify the public IP address ranges currently used by Azure Key Vault, create an outbound security rule that allows traffic to those IP address ranges, and a lower-priority rule that denies traffic to the Internet service tag.
  3. C
    Create a custom User-Defined Route (UDR) in the Subnet1 route table with a destination address prefix of 0.0.0.0/0 pointing to the Virtual Network, and create overlapping route entries pointing to the specific IP addresses of the Azure Key Vault service.
  4. D
    Deploy an outbound Basic Load Balancer to route traffic from the virtual machines to the Azure Key Vault endpoints, and connect the virtual machines to the load balancer using Standard SKU public IP addresses.

Answer

Associate a Network Security Group (NSG) with Subnet1, create an outbound security rule allowing traffic to the AzureKeyVault service tag, and create a lower-priority rule denying traffic to the Internet service tag.
The correct option is to associate a Network Security Group (NSG) with Subnet1, create a rule allowing outbound traffic to the AzureKeyVault service tag, and create a lower-priority rule denying outbound traffic to the Internet service tag. This configuration allows the virtual machines to reach Azure Key Vault securely while blocking all other outbound internet traffic. Using service tags eliminates the need to manage individual IP ranges, minimizing administrative effort.

Step-by-Step Solution

1
Determine the optimal Azure resource for filtering traffic at the subnet level.
Identify that a Network Security Group (NSG) associated with Subnet1 is the standard and most efficient way to filter inbound and outbound network traffic.
NSGs operate at the subnet or network interface level to enforce security rules.
2
Select a method to define the destination for Azure Key Vault traffic that minimizes management effort.
Choose the built-in 'AzureKeyVault' service tag instead of maintaining individual public IP addresses.
Service tags represent a group of IP address prefixes from a given Azure service and are managed automatically by Microsoft, reducing administrative overhead.
3
Configure the rules and priorities to restrict internet access while permitting Key Vault traffic.
Create a higher-priority rule (e.g., priority 100) allowing outbound traffic to the 'AzureKeyVault' service tag, and a lower-priority rule (e.g., priority 200) denying outbound traffic to the 'Internet' service tag.
Rules are processed in priority order, so Key Vault traffic is allowed first before the general internet traffic block is applied.

Key Concept

Azure Network Security Group (NSG) Service Tags allow you to define network access controls for Azure services without manually managing IP addresses, minimizing administrative overhead while securing outbound connections.
Rate this question

Topics

Network Security and Private Access

More questions from this topic