Examkin

Question

Difficulty: MediumNetwork Security and Private Access

A company is designing a network security solution for its virtual machines (VMs) deployed in an Azure virtual network subnet. The VMs must be allowed outbound access to Azure Storage accounts only within the East US region to download updates. Outbound access to the public internet and storage accounts in other regions must be blocked. The solution must minimize administrative effort.

Which configuration should you recommend for the Network Security Group (NSG) associated with the VM subnet?

  1. Create an outbound rule with a priority of 100 that allows traffic to the Storage.EastUS service tag, and a rule with a priority of 200 that denies traffic to the Storage service tag.Answer
  2. B
    Create an outbound rule with a priority of 100 that allows traffic to the individual IP address ranges of the Azure Storage endpoints in the East US region, and a rule with a priority of 200 that denies traffic to the Storage service tag.
  3. C
    Create a User Defined Route (UDR) with a prefix of 0.0.0.0/0 to route all traffic to a virtual appliance, while manually creating overlapping UDRs for each individual storage IP range in East US to bypass the appliance.
  4. D
    Create an outbound rule with a priority of 100 that allows traffic to the Storage service tag, and configure an Application Security Group (ASG) containing the East US storage IP addresses to restrict access.

Answer

Configure an NSG outbound rule with a priority of 100 that allows traffic to the Storage.EastUS service tag, and another rule with a priority of 200 that denies traffic to the Storage service tag.
Using regional service tags such as Storage.EastUS in combination with the broader Storage service tag is the recommended approach to restrict outbound traffic to a specific Azure service region. Since rules are processed in priority order, allowing Storage.EastUS with a higher priority (100) and denying Storage with a lower priority (200) ensures only East US storage traffic is permitted. This design requires minimal administrative effort because Azure automatically updates the IP addresses associated with the service tags.

Step-by-Step Solution

1
Identify the target service and regional requirements.
The target is Azure Storage in the East US region, and all other Storage regions and public internet must be blocked.
This establishes the scope of the required network security rules.
2
Select the appropriate Azure Network Security Group features that minimize administrative effort.
Use Azure Service Tags (specifically the regional tag Storage.EastUS and the global tag Storage) to avoid managing dynamic IP addresses.
Service tags automatically manage IP changes, fulfilling the low-administrative-overhead constraint.
3
Order the NSG rules by priority to allow the subset of traffic while blocking the rest.
Create a rule allowing Storage.EastUS with a higher priority (lower number, e.g., 100) and a rule denying the general Storage tag with a lower priority (higher number, e.g., 200).
NSGs process rules sequentially; the first matching rule is applied, ensuring East US is permitted and all other regions are blocked.

Key Concept

Azure NSG Service Tags and Rule Priority
Rate this question

Topics

Network Security and Private Access

More questions from this topic